3 ms·

The cropped screenshot they show with a TikTok logo gives a false impression of what these prompts look like. It very much looks like a native prompt. https://

The cropped screenshot they show with a TikTok logo gives a false impression of what these prompts look like. It very much looks like a native prompt. https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_asking_for_iphone_passcode/ https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_...

gcr 3y ago
On the post you linked, OP mentioned that tapping "Cancel" still brought them to their FYP page. What native prompt does that? Edit: Another concerning detail is that a native lock screen prompt should show a blurred copy of your phone's background image. This prompt is a single solid color. Edit 2: perhaps a native passkey prompt with session token fallback? if tiktok is trying to upgrade everyone to passkeys, this could be them setting users up early for a smooth migration, but i'm just speculating Edit 3: i downloaded TikTok to test, and am immediately presented with a native Passkey prompt upon opening the app (it infact shows a QR code because I don't have a passkey on my phone). It's likely to be a passkey prompt then. But I am really wondering why it's cancelable without any issues.
dathinab 3y ago
But even if it is native (putting aside that if TikTok is trying to steal a password they would make it look native, and that tbh. that is somewhat unlikely) there is still one problem. What is TikTok doing which triggers the OS to prompt the user for a password? There is some chance that it's something harmless (idk. wield speculative maybe possibility: something like they use some form of passkey API from apple to do client authentication and that API had some changes where it now ask for the password in some situation). There are many more (but unlikely) possibilities where TikTok is doing something bad or outright nefarious. But lets be honest if TikTok is intentionally doing something bad they are quite subtle about it, as not doing so would likely cause more harm for them then it does good. But we know TikTok has in the past multiple times done things which would have gotten a "normal" app developer perm-banned due to a breach of the App stores Terms of Service in a intentional consumer harming way, so it is concerning even if they most most likely don't steal your passwords.

gcr 3y ago

On the post you linked, OP mentioned that tapping "Cancel" still brought them to their FYP page. What native prompt does that? Edit: Another concerning detail is that a native lock screen prompt should show a blurred copy of your phone's background image. This prompt is a single solid color. Edit 2: perhaps a native passkey prompt with session token fallback? if tiktok is trying to upgrade everyone to passkeys, this could be them setting users up early for a smooth migration, but i'm just speculating Edit 3: i downloaded TikTok to test, and am immediately presented with a native Passkey prompt upon opening the app (it infact shows a QR code because I don't have a passkey on my phone). It's likely to be a passkey prompt then. But I am really wondering why it's cancelable without any issues.

dathinab 3y ago

But even if it is native (putting aside that if TikTok is trying to steal a password they would make it look native, and that tbh. that is somewhat unlikely) there is still one problem. What is TikTok doing which triggers the OS to prompt the user for a password? There is some chance that it's something harmless (idk. wield speculative maybe possibility: something like they use some form of passkey API from apple to do client authentication and that API had some changes where it now ask for the password in some situation). There are many more (but unlikely) possibilities where TikTok is doing something bad or outright nefarious. But lets be honest if TikTok is intentionally doing something bad they are quite subtle about it, as not doing so would likely cause more harm for them then it does good. But we know TikTok has in the past multiple times done things which would have gotten a "normal" app developer perm-banned due to a breach of the App stores Terms of Service in a intentional consumer harming way, so it is concerning even if they most most likely don't steal your passwords.