Hacker News Reader

Comment by Etheryte | Hacker News Reader

One thing that I found very interesting when I looked into what TikTok does: it's scary good at aggregating data about you. I live in a foreign country, my phone's network is behind a VPN to a different foreign country and I gave the app no extra permissions, yet somehow I still got recommended content from the country where I was born. Since it's a small country there's no way that's a coincidence. I'm both intrigued and spooked as to how they figured that connection out.

View on HN

I think they use the SIM card country ID and also the ad audience categories to suggest content.

For example swapping the SIM card with a fresh installation of TikTok shows different "local" videos. Even if the public IP address is unchanged like when using WiFi instead of Data.

I've also think they use ad categories to suggest videos. Using a fresh TikTok installation and then spending some time navigating a subreddit of a topic, would likely show videos of that topic the next time you open TikTok.

How could they tell you were on that subreddit? Presumably you were doing it from a separate browser on the phone -- can they really snoop on behavior in completely separate apps?

Indeed they shouldn't be able to know that without deliberately bypassing the phone's security features using vulnerabilities. Maybe confirmation bias is at play here?

I guess it could be the same IPv6 address, or IPv4 + user agent matching with a third party ad categorization service.

> How could they tell you were on that subreddit? Presumably you were doing it from a separate browser on the phone -- can they really snoop on behavior in completely separate apps?

The subreddit was opened in an incognito window, and the native app on the same phone.

+1 on the SIM theory.

Carrier, iso country code, mobile country code, mobile network code, and more are all easily accessible data attributes.

This would make sense on Android, however as far as I've checked, on iOS you can't get this information precisely to reduce tracking.

I had the exact opposite experience. I also live in a foreign country (The Netherlands) and even after explicitly watching content from my native country I still only got videos in Dutch (should mention that I don't even speak Dutch).

Totally off topic but how are you received being a resident in a country and not being able to speak the language? Not that I'm looking to emigrate but damn if your country isn't appealing to the cargo-bike riding cyclist in me.

Basically everybody in the big cities there speaks English on a high level. Same as Copenhagen, Denmark for example.

It's pretty easy to derive longitude with some accuracy simply from active hours. Combine that with population densities and your guesses might get closer, combine that with how long you dwell on some videos or what videos you like and you get closer. Your Opsec isn't as good as you think, it's just nobody has been watching. If you combine statistical guesswork across hundreds of vectors its very easy to narrow your target to a creepy extent. Eliminating some easy leaks is the first step to good opsec but so is reducing your interaction and adding a little chaos.

This argument doesn't really hold up to any scrutiny, by the longitude and active hours logic, the app should've figured out the country that I'm in, not where I was born. This was also on first startup, not after extended use.

I'd probably be more worried about a flaw in your own setup vs TikTok uniquely being able to circumvent it

I'm all ears if you have any suggestions, so far I haven't seen a plausible explanation though.

Could be as simple as one time you forgot to use the VPN.

While this would make sense in a different setup, as I already elaborated under a different comment, this occurred right after I installed the app, not after extended use.

Does your native country use a different language and you have something set to it on your phone? I had a Korean friend get freaked out by similar, but we figured out that he had something fingerprintable set to use Korean even though his interface was set to English.

My home country does have its own language, yes, but all of my devices (and their virtual keyboards) are in English.

I would guess it zeroed in on common interests. Videos you like, comment on, or even just watch for more than one time can all give clues into what interests you.

Sorry for not being clear enough, this was straight after I installed the app. I didn't search for any content or anything, I was simply recommended things that were clearly from my home country.

Are you on iphone or android?

I would guess that your device has been fingerprinted through other app usage you have used, and that fingerprint has an association with the country of your birth.

It's possible that such a service is provided by a state actor, or part of a marketing/advertising service.

I'm on iOS, on Android I wouldn't be surprised by leaking data since that's essentially what the whole platform is built for.

I recall when Apple made device UUID's unique to a specific app install, rather than a device.

Entirely speculation on my part--I assumed that someone would eventually figure out a way to approximate a uuid at the device level, and use that across applications and app installs.

Reply on news.ycombinator.com