5 ms·

I can’t quite figure this out: it sounds like if you click a link in someone’s TikTok content, the in app browser can read any text entered on that site using t

I can’t quite figure this out: it sounds like if you click a link in someone’s TikTok content, the in app browser can read any text entered on that site using the in app browser. Does just not entering any keyboard input in the in app browser mitigate this? Does Apple Lockdown help in this situation? I thought that typical TikTok use just involved scrolling and watching video content. Are users who only view content subject to this security flaw? Thanks in advance for any clarification. Also, off topic but doesn’t YouTube’s “Shorts” take the place of TikTok? I have my Google privacy settings set so YouTube can store my viewing history for one month so I get reasonable recommendations. Does TikTok have similar settings?

ffggvv 4y ago
>> Does just not entering any keyboard input in the in app browser mitigate this? yes but i doubt the hundreds of millions of users, many of which are children, know this
- BoorishBears 4y ago
  To play devil's advocate... the most common way to end up in the in-app browser is to click an ad. Non-technical people don't have a concept of "in app browser sandboxing". In their minds they clicked on an ad, they're still inside TikTok, TikTok's UI is showing, TikTok will show prompts based on the content shown... they probably assume TikTok has access to that page? Honestly I'm more annoyed that Apple allows big apps to use the loophole that is the legacy webview than I am that TikTok uses that webview to do the exact single thing it's good for... having full control over the web content you're showing in app.
  - weird-eye-issue 4y ago
    How do you know that's the most common way? Because I doubt it is. People click links in chats and in their feeds way more than they click ads
    - BoorishBears 4y ago
      That is completely wrong since most users cannot post a website link (hotlink if I need to spell that out...), let alone in a comment. The only way for a non-ad link to be opened from comments is to copy it and paste it in your native browser. Business accounts get a special link field that's part of their bio, so again, deeply embedded in TikTok... and those behave exactly like the ads do. TikTok has a permanent "Flag" UI on top of the site, they replace every page load with a TikTok spinner As expected half the people outraged don't even know what they're outraged about.
      - weird-eye-issue 4y ago
        It's ironic how you were being condescending when you used the term hotlink ("if I need to spell it out...") and yet used the term incorrectly
        BoorishBears 4y ago
        Ironic that you latch onto a completely inconsequential mistake to divert from the fact you had no idea what you were talking about.
        weird-eye-issue 4y ago
        I just didn't feel like further arguing. In that guy's other comment he was talking about Meta/Facebook too which is what I'm most familiar with and was primarily referring to about people clicking on links. Even with TikTok I bet people click on profile links more than ads Also that's not ironic, maybe you are thinking of another word
        BoorishBears 4y ago
        The entire thread from the parent is about TikTok. And "you bet" wrong, since the profile links are only enabled for business accounts. But you're right about one thing: it was not at all ironic you'd deflect. It's exactly what I'd expect after someone misses what a thread about and makes assumptions about a subject they don't know. That was some people call sarcasm.
paxys 4y ago
They do a lot more than that. > TikTok iOS subscribes to every tap on any button, link, image or other component on websites rendered inside the TikTok app. > TikTok iOS uses a JavaScript function to get details about the element the user clicked on, like an image (document.elementFromPoint) And that's just a sample of the calls the author was able to find.
- soheil 4y ago
  If I build an analytics company and build a product that my customers can use to "analyze" their users activity it'd almost be a total neglect on my end not to include common tracking mechanisms that are well documented like simple event hooks in js. I really don't get the rage against tiktok. What they do that is publicly known is not bad. Maybe there is something bad they're doing but these random HN top stories are not it. If NSA/US govt really wants us to avoid tiktok it needs better convincing than "omg they're stealing the x,y of your finger when you tap on an image."
  - mr_toad 4y ago
    If you sold a phone that sent call details back to the manufacturer you’d likely get locked up. Tik tok are not a party to these communications, and they’re not a carrier or service provider. What they’re doing is wire tapping.
    - xvector 4y ago
      TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.
      - hef19898 4y ago
        You are aware of the various privacy laws in a lot of countries?
      - soulofmischief 4y ago
BoorishBears 4y ago
Apple exposes two ways to use an in app browser. One is a legacy method that gives you full control, the other gives the user a sandboxed browser with no interference from the app. TikTok isn't the only app abusing this. Instagram and Facebook will both do sneaky things like respond to the content of the page you're browsing (asking to save passwords in their own private keychain, showing context specific information, etc.) - You're not exposed to any of these if you don't open a link inside the in-app browser. The most common reason to click a link in their in-app browser is an ad... so obviously TikTok, Instagram and Facebook are using the in-app browser to track your interactions after the ad click and sell the data
- hef19898 4y ago
  There is a difference between tracking activities (bad enough) and reading everything you type.
  - BoorishBears 4y ago
    People really want to force outrage on this, but after enough interaction with the ad (scrolling, clicking, typing) TikTok asks about your experience with the ad. TikTok is not pretending to have opened your system browser, it goes very far in doing the opposite: - Hides the normal browser UI - Replaces every page load with a TikTok spinner - Permanently places a TikTok header bar over the screen with a report content button tied to TikTok Combine that with the fact so many people seem to not realize... the only links you can open with the browser are links sold with analytics (ie you can't post arbitrary links as a user commenting) and the outrage just doesn't add up. A completely non-technical user going through that flow would expect that they're still in TikTok and are using TikTok not their browser
- webmobdev 4y ago
  Apple needs to give us power-users the option to decide whether to load such web contents (in apps) in either SFSafariViewController (sandboxed) or WKWebView (fully exposed). This is especially critical when, for example, payment processors load your net banking portal inside apps (a common mode of online payment in India) - unless it is sandboxed, the app and / or payment processor has complete access to your netbanking credentials.

ffggvv 4y ago

>> Does just not entering any keyboard input in the in app browser mitigate this? yes but i doubt the hundreds of millions of users, many of which are children, know this

BoorishBears 4y ago
To play devil's advocate... the most common way to end up in the in-app browser is to click an ad. Non-technical people don't have a concept of "in app browser sandboxing". In their minds they clicked on an ad, they're still inside TikTok, TikTok's UI is showing, TikTok will show prompts based on the content shown... they probably assume TikTok has access to that page? Honestly I'm more annoyed that Apple allows big apps to use the loophole that is the legacy webview than I am that TikTok uses that webview to do the exact single thing it's good for... having full control over the web content you're showing in app.
- weird-eye-issue 4y ago
  How do you know that's the most common way? Because I doubt it is. People click links in chats and in their feeds way more than they click ads
  - BoorishBears 4y ago
    That is completely wrong since most users cannot post a website link (hotlink if I need to spell that out...), let alone in a comment. The only way for a non-ad link to be opened from comments is to copy it and paste it in your native browser. Business accounts get a special link field that's part of their bio, so again, deeply embedded in TikTok... and those behave exactly like the ads do. TikTok has a permanent "Flag" UI on top of the site, they replace every page load with a TikTok spinner As expected half the people outraged don't even know what they're outraged about.
    - weird-eye-issue 4y ago
      It's ironic how you were being condescending when you used the term hotlink ("if I need to spell it out...") and yet used the term incorrectly
      - BoorishBears 4y ago
        Ironic that you latch onto a completely inconsequential mistake to divert from the fact you had no idea what you were talking about.
        weird-eye-issue 4y ago
        I just didn't feel like further arguing. In that guy's other comment he was talking about Meta/Facebook too which is what I'm most familiar with and was primarily referring to about people clicking on links. Even with TikTok I bet people click on profile links more than ads Also that's not ironic, maybe you are thinking of another word
        BoorishBears 4y ago
        The entire thread from the parent is about TikTok. And "you bet" wrong, since the profile links are only enabled for business accounts. But you're right about one thing: it was not at all ironic you'd deflect. It's exactly what I'd expect after someone misses what a thread about and makes assumptions about a subject they don't know. That was some people call sarcasm.

paxys 4y ago

They do a lot more than that. > TikTok iOS subscribes to every tap on any button, link, image or other component on websites rendered inside the TikTok app. > TikTok iOS uses a JavaScript function to get details about the element the user clicked on, like an image (document.elementFromPoint) And that's just a sample of the calls the author was able to find.

soheil 4y ago
If I build an analytics company and build a product that my customers can use to "analyze" their users activity it'd almost be a total neglect on my end not to include common tracking mechanisms that are well documented like simple event hooks in js. I really don't get the rage against tiktok. What they do that is publicly known is not bad. Maybe there is something bad they're doing but these random HN top stories are not it. If NSA/US govt really wants us to avoid tiktok it needs better convincing than "omg they're stealing the x,y of your finger when you tap on an image."
- mr_toad 4y ago
  If you sold a phone that sent call details back to the manufacturer you’d likely get locked up. Tik tok are not a party to these communications, and they’re not a carrier or service provider. What they’re doing is wire tapping.
  - xvector 4y ago
    TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.
    - hef19898 4y ago
      You are aware of the various privacy laws in a lot of countries?
    - soulofmischief 4y ago

BoorishBears 4y ago

Apple exposes two ways to use an in app browser. One is a legacy method that gives you full control, the other gives the user a sandboxed browser with no interference from the app. TikTok isn't the only app abusing this. Instagram and Facebook will both do sneaky things like respond to the content of the page you're browsing (asking to save passwords in their own private keychain, showing context specific information, etc.) - You're not exposed to any of these if you don't open a link inside the in-app browser. The most common reason to click a link in their in-app browser is an ad... so obviously TikTok, Instagram and Facebook are using the in-app browser to track your interactions after the ad click and sell the data

hef19898 4y ago
There is a difference between tracking activities (bad enough) and reading everything you type.
- BoorishBears 4y ago
  People really want to force outrage on this, but after enough interaction with the ad (scrolling, clicking, typing) TikTok asks about your experience with the ad. TikTok is not pretending to have opened your system browser, it goes very far in doing the opposite: - Hides the normal browser UI - Replaces every page load with a TikTok spinner - Permanently places a TikTok header bar over the screen with a report content button tied to TikTok Combine that with the fact so many people seem to not realize... the only links you can open with the browser are links sold with analytics (ie you can't post arbitrary links as a user commenting) and the outrage just doesn't add up. A completely non-technical user going through that flow would expect that they're still in TikTok and are using TikTok not their browser
webmobdev 4y ago
Apple needs to give us power-users the option to decide whether to load such web contents (in apps) in either SFSafariViewController (sandboxed) or WKWebView (fully exposed). This is especially critical when, for example, payment processors load your net banking portal inside apps (a common mode of online payment in India) - unless it is sandboxed, the app and / or payment processor has complete access to your netbanking credentials.