4 ms·

Very unlikely to be accurate. If it was, TikTok wouldn't be on the app stores. * Browsing history: If a user uses a WebView in your app, you can obtain the his

Very unlikely to be accurate. If it was, TikTok wouldn't be on the app stores. * Browsing history: If a user uses a WebView in your app, you can obtain the history of* that WebView instance. Xiaomi phones let applications have access to the first (100?) bytes of each pcap line. [note: this is probably unintended, but their bug bounty programme didn't care]. * Keystroke patterns: You can track user keystrokes within your app. If you're a keyboard or accessibility provider, you can access keystrokes globally. I haven't used TikTok, but it's very unlikely that they do either of these, the UX to enable them is not pleasant because they're dangerous actions to take. * Biometric identifiers: If a user takes a selfie, you have their iris/fingerprint/faceprint

NullPrefix 4y ago
>Xiaomi phones let applications have access to the first (100?) bytes of each pcap line What is pcap line?
- david_allison 4y ago
  A 'row' of packet capture data (in Wireshark's output). I apologize for the lack of clarity. I'm unfamiliar with network terminology and unsure what this looks like on the binary level. The files are in: /storage/emulated/0/MIUI/debug_log/common/tcpdump if you have a phone to test.
  - NullPrefix 4y ago
    Does it refer to just WebView in your own app or general browser app too?
    - david_allison 4y ago
      The standard Android ability to get WebView history is only the history for the instance of the WebView which you created (totally reasonable IMO, there's lots of non-nefarious purposes that you'd want to intercept requests[0]). To my limited understanding, the file on Xiaomi phones is a dump of all the packets that your router would see. If you're using HTTPS, it's probably leaking the sites, but it's mostly garbage. [0] https://github.com/ankidroid/Anki-Android/blob/31cfbc914a7467eaeeeb74a461821f1166d707f5/AnkiDroid/src/main/java/com/ichi2/anki/AbstractFlashcardViewer.kt#L2201-L2223 https://github.com/ankidroid/Anki-Android/blob/31cfbc914a746...

NullPrefix 4y ago

>Xiaomi phones let applications have access to the first (100?) bytes of each pcap line What is pcap line?

david_allison 4y ago
A 'row' of packet capture data (in Wireshark's output). I apologize for the lack of clarity. I'm unfamiliar with network terminology and unsure what this looks like on the binary level. The files are in: /storage/emulated/0/MIUI/debug_log/common/tcpdump if you have a phone to test.
- NullPrefix 4y ago
  Does it refer to just WebView in your own app or general browser app too?
  - david_allison 4y ago
    The standard Android ability to get WebView history is only the history for the instance of the WebView which you created (totally reasonable IMO, there's lots of non-nefarious purposes that you'd want to intercept requests[0]). To my limited understanding, the file on Xiaomi phones is a dump of all the packets that your router would see. If you're using HTTPS, it's probably leaking the sites, but it's mostly garbage. [0] https://github.com/ankidroid/Anki-Android/blob/31cfbc914a7467eaeeeb74a461821f1166d707f5/AnkiDroid/src/main/java/com/ichi2/anki/AbstractFlashcardViewer.kt#L2201-L2223 https://github.com/ankidroid/Anki-Android/blob/31cfbc914a746...