Privacy analysis of Tiktok’s app and website

What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things?

I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups mean since so many major websites use these hacks, so the average user is just going to be conditioned to mindlessly click "Allow All" every time they pop up like UAC on Windows Vista, punishing the average person while doing nothing to enhance their security.

Doesn't help that legislators are absolutely clueless here. For example, demonizing cookies when cookies are the most fair and transparent way to implement tracking, and leading to the first wave of pointless opt-in spam that plagues the internet. I'd rather they leave the internet alone and for browser vendors to step up for us.

Of course, the problem also includes native apps like in TFA. I'm just more optimistic about clients that run in web browsers.

I don't understand. Can anyone unpack this concept for me? How does one generate a sound without a speaker or record without a mic.

Seems obvious once you read how it works. I suppose once you get your mind around how browsers leak and/or persist info, not much of it is surprising anymore.

The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks.

For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which is why browsers have been trying to block some of the more common ways to fingerprint).

But for a script that spawns a thousand AWS instances to sign up 1000 bot accounts that can then be used to sell likes for example, it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.).

An "alternative" to using fingerprints would be to use captchas instead, but bots have gotten much much better at solving captchas. So in fact, ReCaptcha will also use a number of fingerprinting techniques, which is why in many cases you can just click the check box instead of solving a captcha.

AFAIK browser fingerprinting (eg: Fingerprintjs2[0]) at least is nothing like fingerprints at all. It's not accurate and cannot identify a specific person. For websites like TikTok, the same fingerprint might points to 10k different people, instead of an individual. A most common use case is like 'Remember me' option when logging in if they haven't switched their device, but they actually can find other devices that have the same fingerprint.

For example, the most widely used library Fingerprintjs2 uses all the factors that can be grab from the browser (Browser agent, CPU, OS, resolution, etc), and generate a hash from those factors. Even their 'pro' version can only claim 99.5% accuracy, though I doubt the number is actually even lower. For 1M people userbase, it's 5000 people for 0.5% of the population.

[0]: https://github.com/Valve/fingerprintjs2

I still remember the news articles refering a patent Facebook filed about audio fingerprinting as the evidence of Facebook eavesdropping on the people.

Also technologically with some encryption argorithms, a company can claim that they are not capable to identify user with the fingerprint. But in theory given enough data they still can.

I heard it many times that Google knows that a lot of Chinese companies violate their play store policy against using hardware IDs for advertising purposes.

If they stand against it, why they added APIs for accessing them in the first place?

I thought about that for a long time, and finally it struck me: Google very well knows that GDPR prohibits them IDing people if they refuse, so they just added those APIs to let other companies do it for them!

Either way, those links allowed me to install the extensions on desktop Firefox on Windows, so it's all good.

I don't know anything about browser add-ons. Perhaps someone who does could take a look and see what's up?

I guess a real solution would have to come from a collaboration between all browser vendors, like always returning a fixed value when these tricks are detected.

> about:config

> resistfingerprinting -> true

> webgl.disabled -> true

Firefox's fingerprinting protection will block canvas fingerprinting by default (put it behind a prompt). It will also spoof your installed fonts. The second setting I listed will take care of webGL, although it won't be behind a prompt, so it's annoying to re-enable for the (very few) sites that need it. I think resistfingerprinting also handles audio fingerprinting, but I'm not completely sure. I do know it reduces timer precision and a few other things.

Firefox's fingerprinting tools are being uplifted from Tor, which means people who care a lot about this and have a lot of experience in what actually helps are working on it. I am cautious of random extensions even if they're not malicious; it's very easy to get this stuff wrong and accidentally open up a new fingerprinting vector instead.

If you are going to install a new extension, install UMatrix and block Javascript by default. That won't help you with a site like Tiktok's since you'll need to turn Javascript back on for them. But a nontrivial portion of the web works without Javascript, and it really does reduce the number of attack vectors you have.

I keep my extension list very small: Ublock Origin, UMatrix, DecentralEyes, and HTTPS Everywhere. Extension sandboxing is very bad, so I don't like to install new extensions if I can help it. Firefox profiles are very cool and potentially very useful, but I don't currently use them. Maybe that will change in the future.

Not sure if it randomizes things like audio or canvas fingerprints, though.

Already I have to use another browser to use games or other 3D content because I have WebGL disabled in Firefox, and for 2d stuff the resistFingerprinting option reduces timer accuracy, which messes with game loop timing and makes the game totally unplayable. Making audio and video even harder to use is not good.

The only solution is to not allow this stuff to happen in the first place by using a permissions system. Adding more permissions popups is bad, so permission needs to be implicitly allowed by the user. Autoplay is a good example of this, calls to play() are blocked unless the call is being made in response to a click handler. Permissions for really recording audio/video through a webcam/mic also work well.

Whonix is nice. It’s kind of painful to use, but if you need anonymity then it seems to be best in class.

One group of "bad guys" are the ones who want to track what you're doing even after you've cleared your cookies or track you across different domains or different apps. I would argue that this group is the smaller group, but browsers have been taking actions to make their jobs harder, including the "Facebook fence" that Firefox implemented.

There's a second group, which is the cybercriminals (or maybe just grey-market). Think Russian bot farms and purchase fraud bots, but also the guys who sell clicks and followers and rankings, and the ticketmaster bots and black friday bots and such. Those guys do their business by creating thousands or millions of fake accounts, and then funneling their transactions through them. They generally use scripts and cloud farms (sometimes even physical device farms). So app makers and websites need a way to detect when they're being attacked by one of those guys, and the way they do it, is more and more, through fingerprinting.

So every step browser and OS makers take to make the first group of "bad guys" jobs harder also makes the second group of "bad guys" jobs easier, because it makes it easier for them to pretend to be legitimate users.

(My company gets many such reports; sadly researchers often strongly insist otherwise)

news.yc discussion: https://news.ycombinator.com/item?id=19595478

And some techscience.org classics: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Which is an important distinction.

So I would guess you are effectively fingerprinting the combination of browser and GPU. And that does not sound like its easy to fix on the browser side.

> Browser/device fingerprinting for anti-fraud is a well established industry practice. Browser makers don't like this practice and have taken steps to make it harder, but the truth is that it's used across the industry.

If it's that important to you switch off of the web into an App, require sign-ons against an internal system for authentication and policy people actively. Falling back on fingerprinting is a BS excuse used by folks that want to minimize user barriers and maximize the profits they're extracting by push authentication and identification off onto public resources - it isn't ever necessary and it isn't okay.

1. Sending data to Appsflyer is OK in general, but you have to declare to which parties the data will be sent afterwards. As most of the partners will be joint controllers of the data you have to lay open the arrangements with ALL joint controllers: "The arrangement may designate a contact point for data subjects. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject." Tiktok just denied to show any arrangements.

2. Sending data to Facebook is ok in general, but here it's without consent, so it must be covered by legitimate interests. This has to be balanced with the interests of the user and two crucial points are how invasive and how transparent a data procesing is. Sending your search terms to a company you don't even know it's involved and de-anonymising you in the same time (in case you have a app of facebook inc. on your smartphone) hardly can be legitimate interest.

3. Sending data to a non-EU country is OK, but only if the country is secure. This is indeed complex, but: ECJ ruled, that if public authorities have access on a generalised basis to the content of electronic communications, it's not ok, it's even a FUNDAMENTAL violation of the privacy of the users.

4. Browser/Device-Fingerprinting is legally ok. But I doubt that it is used for anti-fraud/security. If it's used for tracking, they probably need consent.

But pretty much everybody does it in China, Baidu etc, like "You phone has 8GB of garbage, download us to clean it", "Download us to boost your signal by 4 times immediately", "This cutie just sent you a message, download us to repsond", basically anything to make you download their apps, and only political problems go punished.

That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet.

It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for people who explicitly provide knowing consent to be tracked, but there are several big caveats—it must be opt in, you can't trick people to opting in, and you can't punish people who don't opt in. (And really, after all of those caveats, what percentage of your userbase will agree to be tracked?)

Unless there's some aspect of GDPR which I don't understand—and please educate me if there is!—95% of the "cookie notices" currently on the web are obvious GDPR violations.

Most meatspace laws are expected to be followed despite there being little to no physical barrier to breaking them (e.g. there's no physical barrier preventing me from throwing a brick through a window, but it would still be vandalism).

Why should we expect laws in software to be different? Why should the burden of compliance be shifted from the individual/company to the infrastructure?