3 ms·

- start on device boot - list of contacts / address book - GPS location (browser can access location too if given permission ofc) - list of devices accessibl

- start on device boot - list of contacts / address book - GPS location (browser can access location too if given permission ofc) - list of devices accessible on local network (if tiktok really is a malware vector this would be a great way to scan users' homes for vulnerable IoT devices) - list of other apps installed on device Advertisers aren't just interested in bucketing you based off headline demographics like what videos you watch, they bucket you with people who have similar behaviors and extrapolate that you will like what they like, so they'll take as many dimensions as they can get to find similarities in behavior. The user fingerprinting is also used to identify you on devices you're not logging in on.

wqaatwt 2y ago
> - list of other apps installed on device Is there are an API for that on iOS?
- jazzyjackson 2y ago
  I thought so but apparently it was patched long ago [0]. Still there on android, tho you’re meant to fall under a set of valid use cases or risk rejection. [1] [0] https://github.com/danielamitay/iHasApp https://github.com/danielamitay/iHasApp [1] https://support.google.com/googleplay/android-developer/answer/10158779?hl=en https://support.google.com/googleplay/android-developer/answ...
nnx 2y ago
> - start on device boot Don't think it's possible on iOS, and I'm doubtful TikTok does this even if it were possible on Android. > - GPS location (browser can access location too if given permission ofc) Actually this AND all of the other fingerprinting methods you listed also require user permission managed by the mobile OS (iOS/Android). In effect there is nothing a 'native' app can get without user knowledge/consent that a web app could not. If there is, it should be considered a bug for mobile OS providers to fix.
- redserk 2y ago
  What about a background data refresh task running and the server geolocating the IP making the request? The accuracy would vary but you could still get reasonably close to assuming someone's nearest city. Background data refresh is reasonably safe to assume everyone has turned on...

wqaatwt 2y ago

> - list of other apps installed on device Is there are an API for that on iOS?

jazzyjackson 2y ago
I thought so but apparently it was patched long ago [0]. Still there on android, tho you’re meant to fall under a set of valid use cases or risk rejection. [1] [0] https://github.com/danielamitay/iHasApp https://github.com/danielamitay/iHasApp [1] https://support.google.com/googleplay/android-developer/answer/10158779?hl=en https://support.google.com/googleplay/android-developer/answ...

nnx 2y ago

> - start on device boot Don't think it's possible on iOS, and I'm doubtful TikTok does this even if it were possible on Android. > - GPS location (browser can access location too if given permission ofc) Actually this AND all of the other fingerprinting methods you listed also require user permission managed by the mobile OS (iOS/Android). In effect there is nothing a 'native' app can get without user knowledge/consent that a web app could not. If there is, it should be considered a bug for mobile OS providers to fix.

redserk 2y ago
What about a background data refresh task running and the server geolocating the IP making the request? The accuracy would vary but you could still get reasonably close to assuming someone's nearest city. Background data refresh is reasonably safe to assume everyone has turned on...