Hacker News Reader

As someone who worked in a field that necessitated some significant anti-fraud measures nope to

> Browser/device fingerprinting for anti-fraud is a well established industry practice. Browser makers don't like this practice and have taken steps to make it harder, but the truth is that it's used across the industry.

If it's that important to you switch off of the web into an App, require sign-ons against an internal system for authentication and policy people actively. Falling back on fingerprinting is a BS excuse used by folks that want to minimize user barriers and maximize the profits they're extracting by push authentication and identification off onto public resources - it isn't ever necessary and it isn't okay.

I bet you've never worked on an e-commerce system then because none of your suggestions work against e-commerce fraud, and you'd literally lose all of your money:

switch off of the web into an App: Can't just shut down your website. Also, device farms and VM farms are super common so it won't even help.

require sign-ons against an internal system for authentication: Sure, you can require your users create an account. Accounts can be created by the thousands by bots. Even if you use captchas, captchas don't work, and even if they did I can find you 100 people who will sign up for accounts manually and sell them to you for 10 cents a piece.

policy people actively: I assume you mean police people effectively. Kind of hard to "police" your customers when a huge percentage of them sign up once, buy something, and maybe only come back 3 years later. In the meantime, their super simple passwords may have been hacked and leaked 10 times already. Maybe you should require your customers all use 2FA. Let's see how many customers you have remaining once you turn that on.

But here's the thing - it does cost money and customers to properly authenticate people. 2FA will lead to less sign ups but it will give you a more secure user base - in a world where DAU is the number to live and die by then security is compromised in order to help float that DAU stat. For sign-ons collect a per account activation fee or subscription fee - if your goal is to only have real users then enforce that with money, if your goal is to allow people to freely browse your site unless they're abusing your site then yea - that's where fingerprinting comes in, and it comes in because that isn't a solvable problem. If you want to know who your users are you need to be upfront about collecting that information securely and if you want any old joe who gets a link to immediately get sucked into browsing your site and looking at ads then just stop basing your business off of dark user patterns - deliver value, charge fairly for that value, realize that lots of potential business ideas would never be profitable because people simply can't be bothered to actually put out money for that service.

This whole fingerprinting debacle is part of the ad-support web assumption, and the assumption that websites can be entirely ad supported is false outside of exceptional circumstance and certainly highly limiting and concerning for free speech - expecting a business to be ad supported, that's pretty much an impossible dream, we're living in a bubble where advertisers and marketers continue to sell lies about the ratios of converting views to actual sales.

Like many things in life, the fight between good actors and bad actors online is a state of dynamic equilibrium.

Everybody loses money to fraud, but as long as they invest enough money and resources they can keep those fraud losses to an acceptable level. Because criminals are infinitely creative, the problem will never be "solved." There will always be new moves and new countermoves.

Total security is an illusion. Everyone who's worth hacking or worth defrauding will get hacked or defrauded sooner or later. The people who have made the necessary investments are able the contain the damage. The other ones, or the really unlucky ones, end up dying off.

Total security is possible but unrealistic. In our modern world we have terrible baseline security, we can do better with some trivial adjustments that the market is countering with a strong disincentive because we as a society haven't placed a clear value on security (outside EU where GDPR has flaws but is an attempt to reward good actors).

This is essentially equivalent to a tragedy of the commons mixed in with a race to the bottom - companies are currently penalized for practicing good security, they are voluntarily accepting lower profit margins in exchange for something nobody cares about, they're also losing access to some supplemental revenue through reselling customer data. If we add decent incentives and make it economical to follow a "good" path we can increase our baseline of security, hacks will always happen but we can minimize the costs of those hacks and their frequency with best practices.

Heck - my standard line with companies w.r.t. PII is that "Your proposal is essentially to collect everyone's alarm code into your safe, your safe has gone from something nobody is interested in to something that, if compromised, could lead to a bunch of people being burglarized." the issue is that over-collecting PII and then, shucks, losing it in that completely unavoidable security compromise, doesn't lead to appreciable punishment for the company - in the real world it sure does (if your locksmith copies your key an extra time then gets burglarized and the burglar uses that extra key to burgle your house the locksmith is absolutely liable and may be found to be a conspirator). It's anomalous that these two worlds are in contrast.

All that said, I absolutely agree that it's a balance and there aren't super simple answers here, but it's important to reject the thought that being as vulnerable as most businesses are is acceptable.

I'm the author and even if I know GDPR quite well as professional journalist I know I can't interprete a law on my own, so I additionally asked an legal expert in this field. So this is what he explained:

1. Sending data to Appsflyer is OK in general, but you have to declare to which parties the data will be sent afterwards. As most of the partners will be joint controllers of the data you have to lay open the arrangements with ALL joint controllers: "The arrangement may designate a contact point for data subjects. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject." Tiktok just denied to show any arrangements.

2. Sending data to Facebook is ok in general, but here it's without consent, so it must be covered by legitimate interests. This has to be balanced with the interests of the user and two crucial points are how invasive and how transparent a data procesing is. Sending your search terms to a company you don't even know it's involved and de-anonymising you in the same time (in case you have a app of facebook inc. on your smartphone) hardly can be legitimate interest.

3. Sending data to a non-EU country is OK, but only if the country is secure. This is indeed complex, but: ECJ ruled, that if public authorities have access on a generalised basis to the content of electronic communications, it's not ok, it's even a FUNDAMENTAL violation of the privacy of the users.

4. Browser/Device-Fingerprinting is legally ok. But I doubt that it is used for anti-fraud/security. If it's used for tracking, they probably need consent.

Consider adding this highly relevant extra information to the main post.

Even though these practices may be legal you'll agree that 99% of the people here are not ok with them. It's not needed to send personal data around the world for tracking. The core functionality of tiktok doesn't need that at all.

> Even though these practices may be legal you'll agree that 99% of the people here are not ok with them

Sad truth is that they are not ok with it only because it's TikTok and it has Chinese origin.

People on HN don't complain about TikTok sending data to Facebook primarily because TikTok is Chinese, but because Facebook is evil.

People on Facebook may hate on TikTok for being Chinese, but I wouldn't know because I don't have a Facebook account. (I don't have a TikTok account either, so it doesn't actually matter much to me whether they snitch to Facebook. But it's about the principle of the matter.)