15 ms·

TikTok tracks you across the web, even if you don’t use the app

368 points by bubblehack3r 4y ago

amelius 4y ago
Except in the EU, I suppose?
- b800h 4y ago
  My guess would be you just get an annoying banner and click "agree to all" on it by habit, then it does the same thing.
- Nextgrid 4y ago
  Why would they, considering nobody gives a shit about punishing GDPR breaches? Google and Facebook are still around and do the same.
_8j50 4y ago
Make shadow profiles illegal.
- rwalle 4y ago
  That is a very realistic vision of how things work in this world.
  - _8j50 4y ago
    It sort of is... you convince your peers and vote.
- YeBanKo 4y ago
  Can be something like, companies can’t store PII without getting explicit user consent.
  - _8j50 4y ago
    They will do it without PII. It can be worded so that collecting any specific information pre and post-processed (to cover ML) about a person who is not a consenting user of your service allows individuals to sue for punitive damages and in exteme cases make it a felony.Any information, even anonymized information about individuals will be prohibited. However, if you use Google for example and agree to their ToS they can do whatever they want within reason, so long as the activity being tracked is related to the user explicitly interacting with a google service. So tracking cookies and all the weird shit they do is fine for their users, they just can't track users if the user visited hn.com and they did not explicitly consent to being tracked by google analytics, the hn.com admin can let you know it wants to allow the 3rd party service google to track you and get your consent. This stuff is possible, I despise all the fatalism. Us, the people that understand this at any depth just need to agree on it and speak very loudly and convince our peers, being defeated and hoping politicians figure out tech some day is silly. That's why I am trying to discuss this here.
- Nextgrid 4y ago
  GDPR would already outlaw those - the problem is that nobody is interested in enforcing it sufficiently to actually deter such behaviour.
DerekBickerton 4y ago
https://archive.ph/RTsuG https://archive.ph/RTsuG
DerekBickerton 4y ago
> You can’t stop data collection from the tech industry altogether, but with a few simple steps you can make a dent in the amount of information that’s being collected. > Use privacy-protecting browser extensions. You can add extensions to your browser that will do a lot to protect your privacy. One is Disconnect, made by the company that performed our TikTok investigation. The Disconnect extension shows you how websites are trying to track you and blocks a lot of that data collection. Privacy experts often recommend uBlock Origin, as well. > Change your browser’s privacy settings. A lot of browsers have built-in controls you can use to block trackers, including cookies, pixels, and other technologies. Open your browser’s preferences or settings, and you’ll usually find the controls in the privacy section. > Try a more private browser. Google Chrome collects a lot of data on behalf of Google. The Consumer Reports Security Planner recommends Firefox and Brave as more privacy-focused options. Case closed when you use uBlock Origin preferably with Brave or Firefox. As an extra measure I disable JS Unless it's really needed, and surf in a private/incognito session to stop cookies building up.
- jszymborski 4y ago
  Shame uMatrix is dead, but I use it to allow javascript for the local domain, and disable for third-party domains by default. It allows me to use at least some websites without too much fiddling with the uMatrix settings.
  - chaxor 4y ago
    What do you mean umatrix is dead? I'm using it now, and it's IMO hands down *the absolute best extension I have ever used*. uMatrix >> (uBO | noScript | privacy badger | cookie ninja | cookie autodelete | etc) I use all of them along with vimium-ff and midnightlizard, but uMatrix is by far the best idea for managing what is run for better privacy and performance of browsing.
    - jszymborski 4y ago
      I use it daily too and it's on my list of essential plugins, but gorhill archived the repo and development has halted as best as I can tell [0] which leads to complications [1]. [0] https://www.ghacks.net/2020/09/20/umatrix-development-has-ended/ https://www.ghacks.net/2020/09/20/umatrix-development-has-en... [1] https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vulnerability-here-is-a-workaround/ https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vul...
lapcat 4y ago
Block the domain analytics.tiktok.com
- giuliomagnifico 4y ago
  Exactly, with a Pi-Hole.
  - vdfs 4y ago
    Regex blacklist: (\.|^)tiktokcdn\.com$ -tiktokcdn-com.akamaized.net$ (\.|^)tiktokv\.com$ (\.|^)musical\.ly$ (\.|^)tiktok\.com$
    - giuliomagnifico 4y ago
      Yes, if you’re lazy or you want to quickly switch some services on/off, I suggest you the great app: Pi-Hole Remote (https://rocketscience-it.nl https://rocketscience-it.nl), there's a handy list with all of the privacy intrusive services (regex) that you can turn on/off with a switch (screenshot https://ibb.co/fNDyq36 https://ibb.co/fNDyq36)
  - cryoz 4y ago
    Unfortunately, the TikTok app falls back on DoH if it detects domain blocking. https://www.reddit.com/r/AppSecurity/comments/f422f3/tiktok_app_possibly_using_dns_over_https_directly/ https://www.reddit.com/r/AppSecurity/comments/f422f3/tiktok_...
    - muppetman 4y ago
      At least it'll stop people who don't have the TikTok app being tracked though.
    - netr0ute 4y ago
      That's ok, DoH firewall rules to the rescue! You can get lists of all known DoH servers and just load them up on a router, drop anything going there, and you're done.
justtosaythanks 4y ago
Thanks for posting this! Ok as a web dev who actively cares about user privacy—- can these things accidentally sneak onto my page through npm deps? Or would I need to install them deliberately? If so —— how are they on gov websites??
- t-writescode 4y ago
  Wild guess: they're part of a default "share buttons" repository that includes the "Share on Twitter, Facebook, Google+" buttons for the page, or something very similar to that.
- aembleton 4y ago
  Couldn't you just try out your webpage in your browser and see what network calls are being made? That way you can see if you're calling Tiktok or not.
nashashmi 4y ago
What is the source of the tracker? It can't be tiktok.com. They must be using a different name domain.
- thakoppno 4y ago
  somewhat related, one time someone mentioned that reddit’s analytics runs off the main domain such that one wouldn’t be able to block analytics without blocking the site and its content itself. does anyone remember the comment or article that mentioned it? it seems like this tactic will be increasingly useful for companies whose revenue is entirely ad dependent. somewhat related, do any ad blocker extensions block POST/PUT but not GET?
- aembleton 4y ago
  analytics.tiktok.com. googletagmanager.com has a script that gets the analytics JS from tiktok, so if you're blocking Google Tag Manager, then you'll never even see an attempt at loading from tiktok.
  - nashashmi 4y ago
    Thanks. For some reason, I never gray listed that site. Now I know better
ramesh31 4y ago
So does everyone else. The question is what are they doing with it.
- localy 4y ago
  Do you think their ties to China make them doing it any more nefarious or no?
  - rawcal 4y ago
    As european I don't assume either US or china has my interests in mind when regulating privacy-invading activity.
    - stjohnswarts 4y ago
      I make the same assumption about Europe and China as well. You can't be too careful
mrj 4y ago
Yeah I had to implement this once because we ran a handful of ads on TikTok, so they wanted access to all of our traffic. I protested, saying they didn't need all traffic to do analytics for people who click through.. just tell me how to identify the traffic you need. This is fair, if somebody clicks on an ad then analytics would be expected. Yeah no, they didn't allow their advertisers to do that. I ended up getting permission to remove from the site when their pixel was found to be causing a performance impact for users. But without good monitoring for that they would have still been running, possibly for forever. I'm sure this is basically how they get to be everywhere.
- nickphx 4y ago
  Why not use the "server to server" api for conversion events?
  - mrj 4y ago
    Egress and runtime restrictions made that difficult at scale, just didn't have extra time.
MengerSponge 4y ago
Tech savvy folks, is it enough to run Privacy badger and uBlock origin (on Firefox)? I also let Firefox use its enhanced tracking protections.
- kuratkull 4y ago
  + uMatrix or NoScript and you have a top notch setup Edit: and maybe something for cookies / cookie banners
- lxchase 4y ago
  It depends what you're trying to solve. I would say it will lower the resolution of any "profiles" built on you in aggregate, but it does not stop a profile being built.
ForOldHack 4y ago
I just wrote the most scathing review I could, and ads pop up for the product. Gee. Thanks. So Every time, I click through and minimize. I know its junk.
mcast 4y ago
When you share a video link on TikTok, it’ll append a bunch of tracking data to know who opened it and notify you. That’s not really a surprise, but what’s more sneaky is they shorten the “shared” video links into a few unique characters without visible tracking data and parameters in the URL (AFAIK they used to visibly expose tracking data on the URL a few years ago but recently started using a URL shortener). ie. https://www.tiktok.com/t/ZTRmqkW4N https://www.tiktok.com/t/ZTRmqkW4N What seems like an inconspicuous and universal URL for a video actually sends a lot of advertising and tracing data back to TikTok’s servers about your friend/you.
- bilsbie 4y ago
  Wow that’s scary. Is there a way to share a video without that?
  - cwillu 4y ago
    Download the video and send it the old-fashioned way, is really the only option.
    - nthitz 4y ago
      You can disable the link tracking thing in settings, bit buried but settings > privacy > suggest your account to others > people who open or send links to you
      - ronsor 4y ago
        The fact that they let you disable it is a miracle
        cwillu 4y ago
        The miracle would be that disabling suggesting your account (as an account to follow) would disable the tracking. And I don't believe in miracles :p
      - 4y ago
olliej 4y ago
As opposed to Google and Facebook, two companies known for their zealous defense of privacy?
- stjohnswarts 4y ago
  That's not the point. No one said other companies didn't do similar things. I assume they all want to get as much info as possible without breaking the law. I think the elephant in the room however is that they also send a copy to the Chinese Communist Party databases as well.
  - frob 4y ago
    s/without breaking the law/without getting caught or punished for breaking the law/
- Eisenstein 4y ago
  There is plenty of room in my heart for hate for all of them!
MikeYasnev007 4y ago
superkuh 4y ago
The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in a dark future where everyone is going to say not automatically running untrusted code is stupid and not a real option. It is. And it works.
- dijit 4y ago
  I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmentation and want life to be easier for them. I get it, their pay check literally depends on them using JS, it adds a lot of flexibility. I'm going to make the additional, controversial, guess that most web-developers don't really know what they're doing either; I would surmise that they lean on frameworks and if those frameworks are ever under threat (from people like me requesting progressive enhancement) then they need to defend the frameworks to defend themselves.
  - iamsaitam 4y ago
    Blaming web developers for this is so out of touch.. since when are the developers in charge of product? It's like blaming a construction worker for the poor architecture of a building. Come on..
    - dijit 4y ago
      If you are asked to make a news website, and you reach for multiple JS frameworks and heavy analytics engines. That is not products fault. Take some responsibility.
Ozzie_osman 4y ago
No surprise. Every company with an ad platform uses a pixel. Meta, Google, Reddit, Microsoft. Advertisers add it to their site to get access to things like tracking of performance if their ads, and custom audiences for retargeting or look-alike audiences. In exchange, that ad platform gets your browsing data. It's not great, but everyone is doing it so I wouldn't consider the fact that TikTok, one of the biggest social media platforms, does it too as news.
- sfvegandude 4y ago
  Apple has an ad platform. Do they use this?
  - eek2121 4y ago
    Apple's ad platform does not track users or their behavior.
    - novok 4y ago
      Lol yes they do: https://www.apple.com/legal/privacy/data/en/apple-advertising/ https://www.apple.com/legal/privacy/data/en/apple-advertisin... Here are a couple: Apple News and Stocks: The topics and categories of the stories you read and the publications you follow, subscribe to, or turn on notifications from. Advertising: Your interactions with ads delivered by Apple’s advertising platform.
    - realusername 4y ago
      They do and unlike a browser you have no control over it
      - sfvegandude 4y ago
        If this were the case, it would be a huge lawsuit, given they state the opposite: You can turn off Personalized Ads on your iOS or iPadOS device by going to Settings > Privacy & Security > Apple Advertising and tapping to turn off Personalized Ads. On Mac, go to System Settings > Privacy & Security > Privacy, click Apple Advertising, and deselect Personalized Ads. The Personalized Ads option may be unavailable if you are a minor, have a managed account, or are in a location where Apple does not deliver advertising to its apps.
blacklight 4y ago
Just use NoScript, uBlock and/or a VPN with a PiHole server as a primary DNS and stop whining. Of course I do hate it that the only way to make money on the web today is though ads and trackers. Of course I hate it to be monitored by sneaky pixels, even if I don't use the app. But the solution to the problem is quite simple: does my browser actually render and run the Javascript? If the answer is no (because the tracking script is either stopped by NoScript, or by uBlock, or by the DNS itself that resolves the tracking domain to 127.0.0.1), then I have no problem. Let's stop whining of IT products tracking every single aspect of our digital lives: almost 30 years down the line, and the Internet hasn't yet figured out a way to make money other than ads and trackers, and it's not going to change any time soon. Instead, let's just make sure that the change happens faster: let's educate people to block all the trackers on all of their devices, so these companies are FORCED to come up with better ways of making money, or they just go burst.
- Zak 4y ago
  That's harder to do on mobile devices. Good system-wide, every-network adblocking on Android requires root. It's hard to obtain root on some devices, and Google is actively aiding app makers to block rooted devices with SafetyNet. I lack experience with iOS, but I assume the situation is worse there. As a practical matter, this means that while I can tell my mother to install uBlock Origin on her desktop browser, it isn't practical for me to tell her to root her phone and run Adaway on it. Of course, most people use smartphones much more than they do PCs lately.
  - CharlesW 4y ago
    > I lack experience with iOS, but I assume the situation is worse there. I use NextDNS (sort of "Pi-hole-as-a-Service"), which provides a "configuration profile […] that will make your device use NextDNS natively using the Encrypted DNS feature". I can't imagine it being any easier, really. https://apple.nextdns.io/ https://apple.nextdns.io/
  - eek2121 4y ago
    iOS is better than you think. allows limited adblocking in Safari, think of it as 'uBlock lite'. Due to limitations regarding size, etc, not everything can be blocked, however, do not track provides a bit more in this sense. Beyond that? Yattee blocks 100% of Youtube ads + sponsorships (I personally do not have an issue with sponsorships, but YouTube can eat it with their ads), Apollo does not show ads for Reddit, etc. (Note that Apollo is the absolute best way to view Reddit on the internet. period.) I suspect Apple will improve things in the future. Media/News companies have attempted to vilify Apple by saying they are 'getting into the ad business', however I suspect that Apple will (as usual) take a user centric approach with expanding their ad business. I am absolutely not the person to defend Apple 24/7, however their privacy practices have been great.
hustwindmaple1 4y ago
Typical practice for any ads-based companies
deleted 4y ago
[deleted]
EastSmith 4y ago
The title should be TikTok (like Google, Meta and other ad companies) now too tracks you across the web. Side question: uBlock Origin + Brave should be enough for this type of tracking, right?
- jacooper 4y ago
  Yes, since its a JS script that will get blocked automatically. And you don't need UBlock with Brave, Nrave shields do the same thing while being faster(rust and integrated in the browser itself) and not being dependent on any extension updates. There is a noticeable performance hit when using uBlock + shields.
plazmatic 4y ago
flenserboy 4y ago
Anything we can toss into the HOSTS file to address this?
- aembleton 4y ago
  127.0.0.1 analytics.tiktok.com 127.0.0.1 googletagmanager.com
  - flenserboy 4y ago
    Nice. Thanks!
princevegeta89 4y ago
Fuck Tiktok. Apart from being a disgustingly deadly teenage trap it is a privacy leech at the same time. It's time people realized how useless and distracting these social media apps are, and that they are not really necessary for any functioning of the society. Real knowledge could come from reading books and sites like Wikipedia. Tiktok is good for nothing other than trapping tennagers to make them get viral by doing some really nasty/dangerous stuff.
- Nextgrid 4y ago
  I would say fuck ad-supported social media. TikTok is no different than Facebook, Twitter, etc besides some China-related fear-mongering (which may be true or not, but the point is, nobody should be stalking people on the internet, regardless of whether the stalker is American or Chinese).
timrice 4y ago
So I have a pi hole for my home network, and a wireguard connection back to it when I'm out and about. I run ublock on everything, block all the javascript, all the stuff. But I do it because ads are annoying -- I don't like how they look and I don't like how they slow down every experience. I...don't really care about the tracking aspect? As far as I can tell, nothing bad happens to people because some faceless entity is tracking all your browser history. Is there some secret malice that I'm not aware of that I should be more concerned about? Near as I can tell all this vast tracking infrastructure is really only there to more precisely target me with ads and doesn't really do anything else. As far as privacy goes, I'm much more weirded out by the fact that my property tax records are public. Or that cell providers have the ability to fairly accurately track my location if they want to. Facebook seems pretty benign compared against that.
- number6 4y ago
  The argument goes, that if they can target you for ads they can also correlate this with political beliefs, your ethnicity, your financial situation and so one. If you want a credit and you are friends with people who don't pay back their debts you are also a risk for the bank and get a higher rate. If you want an insurance and you are a extrem cyclists you won't get one. If you open a shopping side and they know you can afford it, they mark up the price. (Udemy is ridiculously doing this) Yes, this is death by a thousand paper cuts. What could the Chinese Government do with the data? Lower or rise your social credit score? Stop you from visiting China. Throw you in Jail for watching Winnie Poo? All the other tech giants were in the US and so we didn’t have to worried about this. At least if you weren't a terrorist or behaved like one. Now China has a totally different agenda. Is it okay to be LGBTQ in China? What happeneds if you watch a TikTok with this theme?
  - bpye 4y ago
    > At least if you weren't a terrorist or behaved like one. Though sadly there are plenty of false positives here too...
  - timrice 4y ago
    Yes, I am very aware of all the potential dangers, which contributes to my blocking everything in the first place. I am curious if, in the United States, there are any realized dangers to these privacy violations. The Udemy thing is interesting, but it's also (as far as I can tell) just doing stuff with first party cookies and region lookups. Nothing at all the level of sophistication that is being observed from Meta or Tiktok. I'd love to hear stories of people who got screwed because of facebook or Google's broad web of surveillance, but as near as I can tell, nobody is actually being harmed.
1vuio0pswjnm7 4y ago
TikTok proxy, no Javascript required https://proxitok.pabloferreiro.es/ https://proxitok.pabloferreiro.es/
sMarsIntruder 4y ago
Everyday that passes without banning TikTok is a wasted day. Everyone knows that’s a China sponsored spyware, but that’s ok because it’s entertaining!
karxxm 4y ago
No they don’t because I have AdGuard und my local network and on my phone. And I don’t understand why someone would not install this
jgaa 4y ago
No, they don't track me across the web ;) I have js disabled by default on my PC's and laptops. If I need (or want) to use a site that require js, I do so in a VM, and I use that VM only for one or a few related sites (like Hacker News and Slashdot). Each VM has different screen sizes and operating systems / Linux distributions. If I research a subject that is even slightly controversial, I use the Tor browser from a VM or Tails. But mostly, I just ignore companies and organizations that don't know how to make a website work without js.
- paraknight 4y ago
  That sounds like a lot of work for what could be covered by self-destructing cookies, spoofing your user-agent, and in the worst case using Tor (which for me is a keyboard shortcut in Brave). I really don't think the extra hassle of VMs is worth it -- these are ad companies trying to fingerprint you, not state actors using zero-days on you. Personally, I dream of a future where 90% of content is delivered over RSS or similar and the middle man (bloated web pages) are cut out entirely.
  - jgaa 4y ago
    > That sounds like a lot of work It's a matter of principle. And once the VM's are created, they don't add much overhead.
yoaviram 4y ago
If you don't use TikTok, and you happen to live in the EU, UK, California or Brazil, send them a data deletion request. Here's an easy way: https://yourdigitalrights.org/d/tiktok.com https://yourdigitalrights.org/d/tiktok.com
doc_gunthrop 4y ago
Plenty of comments here talking about using uBlock [Origin], piHole, disabling JS, and so on, but it doesn't look like anybody has bothered to ask specifically how TikTok is actually doing the tracking. And TFA doesn't explain the method(s) in any technical detail. I visited several of the sites mentioned in TFA, and uBlock didn't show any connection requests being made to any tiktok-related URLs. Nor were there any unfamiliar websites commonly shared amongst these sites in case TikTok was using a proxy service to hide behind.
- aembleton 4y ago
  I just tried the United Methodist Church website [1] after disabling UBo and accepting cookies. It then GETs an events JS file from tiktok.com, which runs and GETs a main JS file from tiktok.com that then makes a POST request to tiktok.com containing my device, page url, referrer, session ID, useragent and timestamp. If you are running uBlock then you are probably blocking google tag manager that initiates these calls. 1. https://www.umc.org/ https://www.umc.org/
  - doc_gunthrop 4y ago
    Thanks for this. I hadn't considered googletagmanager.com but that appears to be the likely culprit as it is the common denominator between these sites.
f137 4y ago
> The Arizona Department of Economic Security tells TikTok when you view > pages concerned with domestic violence or food assistance. I mean, I understand a random site doing this sh*t, but this is a gov agency, right? What the hell any ad tracking is doing there?
Fatnino 4y ago
Article talking about how tracking pixels are bad. Has Facebook, Twitter and Pintrest tracking pixels front and center above the fold.
jklinger410 4y ago
This is the same technology used by Google, Facebook, Linkedin, Pinterest, Snapchat, and Twitter. There are other services like Clearbit that offer just the data part of this, without the social media network attached. Every major ad network does this. There is nothing unique about TikTok's tracking implementations other than how much data they attempt to take in.

368 points by bubblehack3r 4y ago

amelius 4y ago

Except in the EU, I suppose?

b800h 4y ago
My guess would be you just get an annoying banner and click "agree to all" on it by habit, then it does the same thing.
Nextgrid 4y ago
Why would they, considering nobody gives a shit about punishing GDPR breaches? Google and Facebook are still around and do the same.

_8j50 4y ago

Make shadow profiles illegal.

rwalle 4y ago
That is a very realistic vision of how things work in this world.
- _8j50 4y ago
  It sort of is... you convince your peers and vote.
YeBanKo 4y ago
Can be something like, companies can’t store PII without getting explicit user consent.
- _8j50 4y ago
  They will do it without PII. It can be worded so that collecting any specific information pre and post-processed (to cover ML) about a person who is not a consenting user of your service allows individuals to sue for punitive damages and in exteme cases make it a felony.Any information, even anonymized information about individuals will be prohibited. However, if you use Google for example and agree to their ToS they can do whatever they want within reason, so long as the activity being tracked is related to the user explicitly interacting with a google service. So tracking cookies and all the weird shit they do is fine for their users, they just can't track users if the user visited hn.com and they did not explicitly consent to being tracked by google analytics, the hn.com admin can let you know it wants to allow the 3rd party service google to track you and get your consent. This stuff is possible, I despise all the fatalism. Us, the people that understand this at any depth just need to agree on it and speak very loudly and convince our peers, being defeated and hoping politicians figure out tech some day is silly. That's why I am trying to discuss this here.
Nextgrid 4y ago
GDPR would already outlaw those - the problem is that nobody is interested in enforcing it sufficiently to actually deter such behaviour.

DerekBickerton 4y ago

https://archive.ph/RTsuG https://archive.ph/RTsuG

DerekBickerton 4y ago

> You can’t stop data collection from the tech industry altogether, but with a few simple steps you can make a dent in the amount of information that’s being collected. > Use privacy-protecting browser extensions. You can add extensions to your browser that will do a lot to protect your privacy. One is Disconnect, made by the company that performed our TikTok investigation. The Disconnect extension shows you how websites are trying to track you and blocks a lot of that data collection. Privacy experts often recommend uBlock Origin, as well. > Change your browser’s privacy settings. A lot of browsers have built-in controls you can use to block trackers, including cookies, pixels, and other technologies. Open your browser’s preferences or settings, and you’ll usually find the controls in the privacy section. > Try a more private browser. Google Chrome collects a lot of data on behalf of Google. The Consumer Reports Security Planner recommends Firefox and Brave as more privacy-focused options. Case closed when you use uBlock Origin preferably with Brave or Firefox. As an extra measure I disable JS Unless it's really needed, and surf in a private/incognito session to stop cookies building up.

jszymborski 4y ago
Shame uMatrix is dead, but I use it to allow javascript for the local domain, and disable for third-party domains by default. It allows me to use at least some websites without too much fiddling with the uMatrix settings.
- chaxor 4y ago
  What do you mean umatrix is dead? I'm using it now, and it's IMO hands down *the absolute best extension I have ever used*. uMatrix >> (uBO | noScript | privacy badger | cookie ninja | cookie autodelete | etc) I use all of them along with vimium-ff and midnightlizard, but uMatrix is by far the best idea for managing what is run for better privacy and performance of browsing.
  - jszymborski 4y ago
    I use it daily too and it's on my list of essential plugins, but gorhill archived the repo and development has halted as best as I can tell [0] which leads to complications [1]. [0] https://www.ghacks.net/2020/09/20/umatrix-development-has-ended/ https://www.ghacks.net/2020/09/20/umatrix-development-has-en... [1] https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vulnerability-here-is-a-workaround/ https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vul...

lapcat 4y ago

Block the domain analytics.tiktok.com

giuliomagnifico 4y ago
Exactly, with a Pi-Hole.
- vdfs 4y ago
  Regex blacklist: (\.|^)tiktokcdn\.com$ -tiktokcdn-com.akamaized.net$ (\.|^)tiktokv\.com$ (\.|^)musical\.ly$ (\.|^)tiktok\.com$
  - giuliomagnifico 4y ago
    Yes, if you’re lazy or you want to quickly switch some services on/off, I suggest you the great app: Pi-Hole Remote (https://rocketscience-it.nl https://rocketscience-it.nl), there's a handy list with all of the privacy intrusive services (regex) that you can turn on/off with a switch (screenshot https://ibb.co/fNDyq36 https://ibb.co/fNDyq36)
- cryoz 4y ago
  Unfortunately, the TikTok app falls back on DoH if it detects domain blocking. https://www.reddit.com/r/AppSecurity/comments/f422f3/tiktok_app_possibly_using_dns_over_https_directly/ https://www.reddit.com/r/AppSecurity/comments/f422f3/tiktok_...
  - muppetman 4y ago
    At least it'll stop people who don't have the TikTok app being tracked though.
  - netr0ute 4y ago
    That's ok, DoH firewall rules to the rescue! You can get lists of all known DoH servers and just load them up on a router, drop anything going there, and you're done.

justtosaythanks 4y ago

Thanks for posting this! Ok as a web dev who actively cares about user privacy—- can these things accidentally sneak onto my page through npm deps? Or would I need to install them deliberately? If so —— how are they on gov websites??

t-writescode 4y ago
Wild guess: they're part of a default "share buttons" repository that includes the "Share on Twitter, Facebook, Google+" buttons for the page, or something very similar to that.
aembleton 4y ago
Couldn't you just try out your webpage in your browser and see what network calls are being made? That way you can see if you're calling Tiktok or not.

nashashmi 4y ago

What is the source of the tracker? It can't be tiktok.com. They must be using a different name domain.

thakoppno 4y ago
somewhat related, one time someone mentioned that reddit’s analytics runs off the main domain such that one wouldn’t be able to block analytics without blocking the site and its content itself. does anyone remember the comment or article that mentioned it? it seems like this tactic will be increasingly useful for companies whose revenue is entirely ad dependent. somewhat related, do any ad blocker extensions block POST/PUT but not GET?
aembleton 4y ago
analytics.tiktok.com. googletagmanager.com has a script that gets the analytics JS from tiktok, so if you're blocking Google Tag Manager, then you'll never even see an attempt at loading from tiktok.
- nashashmi 4y ago
  Thanks. For some reason, I never gray listed that site. Now I know better

ramesh31 4y ago

So does everyone else. The question is what are they doing with it.

localy 4y ago
Do you think their ties to China make them doing it any more nefarious or no?
- rawcal 4y ago
  As european I don't assume either US or china has my interests in mind when regulating privacy-invading activity.
  - stjohnswarts 4y ago
    I make the same assumption about Europe and China as well. You can't be too careful

mrj 4y ago

Yeah I had to implement this once because we ran a handful of ads on TikTok, so they wanted access to all of our traffic. I protested, saying they didn't need all traffic to do analytics for people who click through.. just tell me how to identify the traffic you need. This is fair, if somebody clicks on an ad then analytics would be expected. Yeah no, they didn't allow their advertisers to do that. I ended up getting permission to remove from the site when their pixel was found to be causing a performance impact for users. But without good monitoring for that they would have still been running, possibly for forever. I'm sure this is basically how they get to be everywhere.

nickphx 4y ago
Why not use the "server to server" api for conversion events?
- mrj 4y ago
  Egress and runtime restrictions made that difficult at scale, just didn't have extra time.

MengerSponge 4y ago

Tech savvy folks, is it enough to run Privacy badger and uBlock origin (on Firefox)? I also let Firefox use its enhanced tracking protections.

kuratkull 4y ago
+ uMatrix or NoScript and you have a top notch setup Edit: and maybe something for cookies / cookie banners
lxchase 4y ago
It depends what you're trying to solve. I would say it will lower the resolution of any "profiles" built on you in aggregate, but it does not stop a profile being built.

ForOldHack 4y ago

I just wrote the most scathing review I could, and ads pop up for the product. Gee. Thanks. So Every time, I click through and minimize. I know its junk.

mcast 4y ago

When you share a video link on TikTok, it’ll append a bunch of tracking data to know who opened it and notify you. That’s not really a surprise, but what’s more sneaky is they shorten the “shared” video links into a few unique characters without visible tracking data and parameters in the URL (AFAIK they used to visibly expose tracking data on the URL a few years ago but recently started using a URL shortener). ie. https://www.tiktok.com/t/ZTRmqkW4N https://www.tiktok.com/t/ZTRmqkW4N What seems like an inconspicuous and universal URL for a video actually sends a lot of advertising and tracing data back to TikTok’s servers about your friend/you.

bilsbie 4y ago
Wow that’s scary. Is there a way to share a video without that?
- cwillu 4y ago
  Download the video and send it the old-fashioned way, is really the only option.
  - nthitz 4y ago
    You can disable the link tracking thing in settings, bit buried but settings > privacy > suggest your account to others > people who open or send links to you
    - ronsor 4y ago
      The fact that they let you disable it is a miracle
      - cwillu 4y ago
        The miracle would be that disabling suggesting your account (as an account to follow) would disable the tracking. And I don't believe in miracles :p
    - 4y ago

olliej 4y ago

As opposed to Google and Facebook, two companies known for their zealous defense of privacy?

stjohnswarts 4y ago
That's not the point. No one said other companies didn't do similar things. I assume they all want to get as much info as possible without breaking the law. I think the elephant in the room however is that they also send a copy to the Chinese Communist Party databases as well.
- frob 4y ago
  s/without breaking the law/without getting caught or punished for breaking the law/
Eisenstein 4y ago
There is plenty of room in my heart for hate for all of them!

MikeYasnev007 4y ago

superkuh 4y ago

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in a dark future where everyone is going to say not automatically running untrusted code is stupid and not a real option. It is. And it works.

dijit 4y ago
I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmentation and want life to be easier for them. I get it, their pay check literally depends on them using JS, it adds a lot of flexibility. I'm going to make the additional, controversial, guess that most web-developers don't really know what they're doing either; I would surmise that they lean on frameworks and if those frameworks are ever under threat (from people like me requesting progressive enhancement) then they need to defend the frameworks to defend themselves.
- iamsaitam 4y ago
  Blaming web developers for this is so out of touch.. since when are the developers in charge of product? It's like blaming a construction worker for the poor architecture of a building. Come on..
  - dijit 4y ago
    If you are asked to make a news website, and you reach for multiple JS frameworks and heavy analytics engines. That is not products fault. Take some responsibility.

Ozzie_osman 4y ago

No surprise. Every company with an ad platform uses a pixel. Meta, Google, Reddit, Microsoft. Advertisers add it to their site to get access to things like tracking of performance if their ads, and custom audiences for retargeting or look-alike audiences. In exchange, that ad platform gets your browsing data. It's not great, but everyone is doing it so I wouldn't consider the fact that TikTok, one of the biggest social media platforms, does it too as news.

sfvegandude 4y ago
Apple has an ad platform. Do they use this?
- eek2121 4y ago
  Apple's ad platform does not track users or their behavior.
  - novok 4y ago
    Lol yes they do: https://www.apple.com/legal/privacy/data/en/apple-advertising/ https://www.apple.com/legal/privacy/data/en/apple-advertisin... Here are a couple: Apple News and Stocks: The topics and categories of the stories you read and the publications you follow, subscribe to, or turn on notifications from. Advertising: Your interactions with ads delivered by Apple’s advertising platform.
  - realusername 4y ago
    They do and unlike a browser you have no control over it
    - sfvegandude 4y ago
      If this were the case, it would be a huge lawsuit, given they state the opposite: You can turn off Personalized Ads on your iOS or iPadOS device by going to Settings > Privacy & Security > Apple Advertising and tapping to turn off Personalized Ads. On Mac, go to System Settings > Privacy & Security > Privacy, click Apple Advertising, and deselect Personalized Ads. The Personalized Ads option may be unavailable if you are a minor, have a managed account, or are in a location where Apple does not deliver advertising to its apps.

blacklight 4y ago

Just use NoScript, uBlock and/or a VPN with a PiHole server as a primary DNS and stop whining. Of course I do hate it that the only way to make money on the web today is though ads and trackers. Of course I hate it to be monitored by sneaky pixels, even if I don't use the app. But the solution to the problem is quite simple: does my browser actually render and run the Javascript? If the answer is no (because the tracking script is either stopped by NoScript, or by uBlock, or by the DNS itself that resolves the tracking domain to 127.0.0.1), then I have no problem. Let's stop whining of IT products tracking every single aspect of our digital lives: almost 30 years down the line, and the Internet hasn't yet figured out a way to make money other than ads and trackers, and it's not going to change any time soon. Instead, let's just make sure that the change happens faster: let's educate people to block all the trackers on all of their devices, so these companies are FORCED to come up with better ways of making money, or they just go burst.

Zak 4y ago
That's harder to do on mobile devices. Good system-wide, every-network adblocking on Android requires root. It's hard to obtain root on some devices, and Google is actively aiding app makers to block rooted devices with SafetyNet. I lack experience with iOS, but I assume the situation is worse there. As a practical matter, this means that while I can tell my mother to install uBlock Origin on her desktop browser, it isn't practical for me to tell her to root her phone and run Adaway on it. Of course, most people use smartphones much more than they do PCs lately.
- CharlesW 4y ago
  > I lack experience with iOS, but I assume the situation is worse there. I use NextDNS (sort of "Pi-hole-as-a-Service"), which provides a "configuration profile […] that will make your device use NextDNS natively using the Encrypted DNS feature". I can't imagine it being any easier, really. https://apple.nextdns.io/ https://apple.nextdns.io/
- eek2121 4y ago
  iOS is better than you think. allows limited adblocking in Safari, think of it as 'uBlock lite'. Due to limitations regarding size, etc, not everything can be blocked, however, do not track provides a bit more in this sense. Beyond that? Yattee blocks 100% of Youtube ads + sponsorships (I personally do not have an issue with sponsorships, but YouTube can eat it with their ads), Apollo does not show ads for Reddit, etc. (Note that Apollo is the absolute best way to view Reddit on the internet. period.) I suspect Apple will improve things in the future. Media/News companies have attempted to vilify Apple by saying they are 'getting into the ad business', however I suspect that Apple will (as usual) take a user centric approach with expanding their ad business. I am absolutely not the person to defend Apple 24/7, however their privacy practices have been great.

hustwindmaple1 4y ago

Typical practice for any ads-based companies

deleted 4y ago

[deleted]

EastSmith 4y ago

The title should be TikTok (like Google, Meta and other ad companies) now too tracks you across the web. Side question: uBlock Origin + Brave should be enough for this type of tracking, right?

jacooper 4y ago
Yes, since its a JS script that will get blocked automatically. And you don't need UBlock with Brave, Nrave shields do the same thing while being faster(rust and integrated in the browser itself) and not being dependent on any extension updates. There is a noticeable performance hit when using uBlock + shields.

plazmatic 4y ago

flenserboy 4y ago

Anything we can toss into the HOSTS file to address this?

aembleton 4y ago
127.0.0.1 analytics.tiktok.com 127.0.0.1 googletagmanager.com
- flenserboy 4y ago
  Nice. Thanks!

princevegeta89 4y ago

Fuck Tiktok. Apart from being a disgustingly deadly teenage trap it is a privacy leech at the same time. It's time people realized how useless and distracting these social media apps are, and that they are not really necessary for any functioning of the society. Real knowledge could come from reading books and sites like Wikipedia. Tiktok is good for nothing other than trapping tennagers to make them get viral by doing some really nasty/dangerous stuff.

Nextgrid 4y ago
I would say fuck ad-supported social media. TikTok is no different than Facebook, Twitter, etc besides some China-related fear-mongering (which may be true or not, but the point is, nobody should be stalking people on the internet, regardless of whether the stalker is American or Chinese).

timrice 4y ago

So I have a pi hole for my home network, and a wireguard connection back to it when I'm out and about. I run ublock on everything, block all the javascript, all the stuff. But I do it because ads are annoying -- I don't like how they look and I don't like how they slow down every experience. I...don't really care about the tracking aspect? As far as I can tell, nothing bad happens to people because some faceless entity is tracking all your browser history. Is there some secret malice that I'm not aware of that I should be more concerned about? Near as I can tell all this vast tracking infrastructure is really only there to more precisely target me with ads and doesn't really do anything else. As far as privacy goes, I'm much more weirded out by the fact that my property tax records are public. Or that cell providers have the ability to fairly accurately track my location if they want to. Facebook seems pretty benign compared against that.

number6 4y ago
The argument goes, that if they can target you for ads they can also correlate this with political beliefs, your ethnicity, your financial situation and so one. If you want a credit and you are friends with people who don't pay back their debts you are also a risk for the bank and get a higher rate. If you want an insurance and you are a extrem cyclists you won't get one. If you open a shopping side and they know you can afford it, they mark up the price. (Udemy is ridiculously doing this) Yes, this is death by a thousand paper cuts. What could the Chinese Government do with the data? Lower or rise your social credit score? Stop you from visiting China. Throw you in Jail for watching Winnie Poo? All the other tech giants were in the US and so we didn’t have to worried about this. At least if you weren't a terrorist or behaved like one. Now China has a totally different agenda. Is it okay to be LGBTQ in China? What happeneds if you watch a TikTok with this theme?
- bpye 4y ago
  > At least if you weren't a terrorist or behaved like one. Though sadly there are plenty of false positives here too...
- timrice 4y ago
  Yes, I am very aware of all the potential dangers, which contributes to my blocking everything in the first place. I am curious if, in the United States, there are any realized dangers to these privacy violations. The Udemy thing is interesting, but it's also (as far as I can tell) just doing stuff with first party cookies and region lookups. Nothing at all the level of sophistication that is being observed from Meta or Tiktok. I'd love to hear stories of people who got screwed because of facebook or Google's broad web of surveillance, but as near as I can tell, nobody is actually being harmed.

1vuio0pswjnm7 4y ago

TikTok proxy, no Javascript required https://proxitok.pabloferreiro.es/ https://proxitok.pabloferreiro.es/

sMarsIntruder 4y ago

Everyday that passes without banning TikTok is a wasted day. Everyone knows that’s a China sponsored spyware, but that’s ok because it’s entertaining!

karxxm 4y ago

No they don’t because I have AdGuard und my local network and on my phone. And I don’t understand why someone would not install this

jgaa 4y ago

No, they don't track me across the web ;) I have js disabled by default on my PC's and laptops. If I need (or want) to use a site that require js, I do so in a VM, and I use that VM only for one or a few related sites (like Hacker News and Slashdot). Each VM has different screen sizes and operating systems / Linux distributions. If I research a subject that is even slightly controversial, I use the Tor browser from a VM or Tails. But mostly, I just ignore companies and organizations that don't know how to make a website work without js.

paraknight 4y ago
That sounds like a lot of work for what could be covered by self-destructing cookies, spoofing your user-agent, and in the worst case using Tor (which for me is a keyboard shortcut in Brave). I really don't think the extra hassle of VMs is worth it -- these are ad companies trying to fingerprint you, not state actors using zero-days on you. Personally, I dream of a future where 90% of content is delivered over RSS or similar and the middle man (bloated web pages) are cut out entirely.
- jgaa 4y ago
  > That sounds like a lot of work It's a matter of principle. And once the VM's are created, they don't add much overhead.

yoaviram 4y ago

If you don't use TikTok, and you happen to live in the EU, UK, California or Brazil, send them a data deletion request. Here's an easy way: https://yourdigitalrights.org/d/tiktok.com https://yourdigitalrights.org/d/tiktok.com

doc_gunthrop 4y ago

Plenty of comments here talking about using uBlock [Origin], piHole, disabling JS, and so on, but it doesn't look like anybody has bothered to ask specifically how TikTok is actually doing the tracking. And TFA doesn't explain the method(s) in any technical detail. I visited several of the sites mentioned in TFA, and uBlock didn't show any connection requests being made to any tiktok-related URLs. Nor were there any unfamiliar websites commonly shared amongst these sites in case TikTok was using a proxy service to hide behind.

aembleton 4y ago
I just tried the United Methodist Church website [1] after disabling UBo and accepting cookies. It then GETs an events JS file from tiktok.com, which runs and GETs a main JS file from tiktok.com that then makes a POST request to tiktok.com containing my device, page url, referrer, session ID, useragent and timestamp. If you are running uBlock then you are probably blocking google tag manager that initiates these calls. 1. https://www.umc.org/ https://www.umc.org/
- doc_gunthrop 4y ago
  Thanks for this. I hadn't considered googletagmanager.com but that appears to be the likely culprit as it is the common denominator between these sites.

f137 4y ago

> The Arizona Department of Economic Security tells TikTok when you view > pages concerned with domestic violence or food assistance. I mean, I understand a random site doing this sh*t, but this is a gov agency, right? What the hell any ad tracking is doing there?

Fatnino 4y ago

Article talking about how tracking pixels are bad. Has Facebook, Twitter and Pintrest tracking pixels front and center above the fold.

jklinger410 4y ago

This is the same technology used by Google, Facebook, Linkedin, Pinterest, Snapchat, and Twitter. There are other services like Clearbit that offer just the data part of this, without the social media network attached. Every major ad network does this. There is nothing unique about TikTok's tracking implementations other than how much data they attempt to take in.