Hacker News Reader

Comment by avocado4 | Hacker News Reader

Also if you check the AndroidManifest.xml of TikTok app you'll see they are tracking persistent device identifiers coupled with phone #. Then if you uninstall TikTok you'll still have a bunch of their files in shared space that other Chinese apps can pick up were you to install them, presumably so they can track you even if you uninstall the app.

View on HN

Relevant HN submission about this kind of behavior: https://news.ycombinator.com/item?id=21071746

Is this something we can report? Or is it allowed in Android?

It's a bad practice according to Google, but not forbidden.

https://developer.android.com/training/articles/user-data-id...

Is there a way to prevent an app from leaking data put like this, e.g, some kind of sandbox disk where files written with one app cannot be accessed by another app (until the user allows it - like photo sharing etc)?

A container, for example?

Android has this but it works on the app authors side. Each app has its own private storage space where other apps and even the device owner(!!) can't access. There is then a shared /sdcard folder which apps must request permission to use (Access device storage). Tiktok is requesting this sdcard folder access and dropping trackers in it. Android does allow you to deny this permission but the app will probably require it to share images (Even though I'm pretty sure android provides a ui for sending images without storage access)

This would be enforced in the next version of Android IIRC. If you happen to have a rooted device and trust closed-source app you can also try Storage Redirect ( https://rikka.app/storage_redirect/ )

Can't you simply deny TikTok access to shared storage? This permission has been part of Android for a few years now.

Is that so? I decompile the v7.4.6 APK file through javadecompilers.com and only find out they ask for several devices permission. Also, I think if they want to do this they will not put it in the AndroidManifest.xml because this file is not able to store the ID of devices and it will make it super easy for us to sue them.

Who are you? You only registered to make this one comment, denying the claims without any backing information and while promoting a random website / service. I'm not sure you're acting in good faith and I wonder whose payroll you're on.

In fact, this is the first news I'm interested in because I use TikTok often. I'm sorry and I'm really just a beginner in programming. The website is used to decompile the APK file so that I can see through the XML file, but I just haven't figured out how they track persistent device identifiers in the XML file. Maybe just because I am not familiar with Android and I should do my research first...

Sorry again.

Reply on news.ycombinator.com