Amazon says email banning TikTok from employee phones was ‘sent in error’

https://en.wikipedia.org/wiki/Mobile_device_management

My assumption was that any apps installed on the personal partition were off limit for the MDM.

If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere.

...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about.

There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.

The other is the way they hide what they're doing so elaborately.

I wouldn't call it a national security concern, no. Someone who works with critical or military infrastructure should have a locked-down phone anyway for work stuff.

But really I wonder how this kind of stuff is OK in the eyes of Apple with their self-proclaimed privacy focus. I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. Popularity seems to overrule that.

We found out other apps too (like LinkedIn) constantly check the clipboard, and one HN commenter here said it was due to a text editing library, nothing intentional.

Literally the only fact is that it's a Chinese company.

And it's not like there's even much it seems like they could do, with how sandboxed phone apps are. I'm not saying iOS or Android are perfectly secure, but it't totally different from installing something on your desktop with root permissions.

Either it's just generic hate for China that's bizarrely gone viral, or else it's a story intentionally being pushed by the US government for god-only-knows what political reason, like leverage in trade negotiations or something.

But it's completely weird, and nobody should be taking it at face value.

https://penetrum.com/research

https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...

https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd...

Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled - App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it. - Files may contain hardcoded informations like usernames, passwords, keys etc.

Amazon probably decided most employees don't have anything too sensitive and it's not worth buying everyone a phone.

I know that if you craft your buffer overflow just right it will overwrite other parts of memory with the new function.

But how do you know what parts will get overwritten?

Does that mean the new function can do almost anything?

if I were a billionaire I'd basically not stop until I got to the bottom of this one. everyone is vulnerable.

> Be kind. Don't be snarky...Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.

> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

https://news.ycombinator.com/newsguidelines.html

It's not an accident that one of the stupidest, most theocratic countries in the middle east receives the most weapons and support from the USA.

We don't want a strong middle east. This is why countries like Iran, Lebanon, Syria are labelled as "terrorist".

Although it seems the online records are disappearing fast. I could not find a good source of the TikTok history and key figures any more...

Tiktok is not some extra special danger, except to those who have extra fear of a Chinese owned company. India has banned Tiktok, around the same time they've had border skirmishes with China and are running a big nationalist government.

As an aside, it's insane to me that the differentiating feature of an entirely new video hosting platform can simply be the length of the content it supports.

The world of tech companies is truly bizarre. Why doesn't Google launch dozens of Youtube variants under their own branding with their own slightly different length restrictions to just dominate the market?

surprised there hasn't been any controversy about that - tiktok is a predator's paradise.

https://buffer.com/library/social-media-sites/

Orkut: stagnated and killed

G+: design by committee as you said

YT: acquired but the social aspects are down the drain

We can complain about FB and Zuckerberg as much as we want but they knew how to evolve the network and keep the users

Edit: Oh, I forgot the one staring me in the face—Youtube! It's no less of a social network than TikTok.

It falls under the category of providing your own resources to do your job, and that territory enters socioeconomic discrimination territory real quick.

The first of these could sometimes have implications for ownership of personal projects created using the device, which was one of many reasons I picked the second option, but it was absolutely permitted at least for any case where the company cared about you having mobile account access.

Seriously, they could be logging your exact location, remotely activating the camera or doing any number of disgusting things.

Requiring the use of a spy should not be a factor in an employment setting, of course we're seeing this is the case and it is very offputting.

Thankfully not something I need to worry about though.

> Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise.

Not true (source: current MSFT employee). More detailed explanation below, as neither former nor latter describes MSFT accurately.

So, for most teams and positions (there are many exceptions), you don't get a dedicated work phone. So yeah, if you want to access work stuff on a mobile device, you need to install MSFT MDM on your personal phone, and they will, allegedly, be able to control stuff on it (depending on the device itself and how MDM is configured).

However, there are no requirements to do it. You can simply not install any work-related stuff on your phone, so you won't need an MDM. I simply don't access any work resources on my personal phone. If I need to do work, i open my work laptop. If they want me to use work apps on mobile and be accessible, they should provide a company phone for this.

There have been zero conflicts around it on my end, even after multiple years of working there on multiple different teams. Not once have I even got an implied request from anyone (managers, colleagues, etc.) to be accessible on mobile (except for when I am on-call, but for that, they just need my phone number, not any specific apps installed on my phone, and everyone knows it) or any questions about it. Everyone is totally cool with people not being glued to their work apps on their phones on their own free time.

But you are correct, those who choose to use work apps have to give MDM permissions to their personal devices or buy a dedicated device for that (exceptions apply, because there are some teams that provide dedicated work phones). However, unless it is required for the job to be able to use work apps on your mobile device, I think it is fair if they don't provide a work phone. Makes it easier for me to not check on any work stuff during the weekend.

He never got one, because as he said, if they have your number they'll call you, if they don't then they'll solve their own problem. Looking back on it now, it was prescient advice.

So what... Sometimes I go to the shop or bank during the day. Or even a walk to the beach if it's not so busy. They're paying me to do a (global) job, not to sit at my desk between 9:00 and 17:00.

Personally I love this flexibility. And I don't feel like I work more than 40 hours, I don't even count them but I doubt I do, especially if I omit the time I spend during "working hours" reading hacker news or other stuff. My work is my hobby anyway.

I do think people who like having fixed work times should have the opportunity to have them. But I also think people like me should be able to work like this without it being considered a bad thing.

I think enough money can buy silence from a lot of people, plus it's clear google already has the tech, as they show a banner on every thing relating to covid (search results, YouTube) and do a quite impressive job at that. So I guess they can just tweak it for dragonfly, or even get their Chinese employees to do the tweak, since they already hire in China.

Once the growth slows, companies look for alternative revenue sources, like Apple is doing with services. The problem is that google has shown itself to be wildly incompetent at non engineering parts of their businesses other than search. e.g, Google cloud might be the only cloud to raise prices for anything so far(Google Kubernetes Engine price update)

It will be interesting to see what they choose. I don't think dragonfly can make them much money anyways, since Baidu too isn't making a lot of money in China.(When compared to how much Google makes in the US). I guess mostly due to closed mini app ecosystem on wechat, and probably a smaller internet eco system outside wechat.

https://en.m.wikipedia.org/wiki/Dragonfly_(search_engine)

>No other app is even close to allowed that.

So an app that is on like a billions people phone is knowingly doing things against google & apples app store policy.. yet they choose to let one of the largest apps exploit them?

If you can read the above and not see why there is a pretty large obvious logic flaw then it's not even worth attempting to convince you otherwise...

China is increasingly an adversary to the US. That context is going to get a lot worse this decade. TikTok is owned by a Chinese company and ultimately must (and will) answer to China. Facebook, Google, et al. are of course American companies.

For a nation, whether Facebook concerns you as much as TikTok depends largely on which side you're on (or if you have a side at all).

The world is going to be aggressively bifurcated, US-USSR style, going forward. There will be the liberal side and the China side. China's direction is fundamentally opposed to the major liberal nations, what they commonly believe in and how their systems operate. That conflict and incompatibility will get worse as China's behavior continues to get worse.

What benefit would they get?