Hacker News Reader

Comment by gambiting | Hacker News Reader

>>Everything they're accusing TikTok of - from data harvesting to the government having access to said data - is true for western companies as well and that should be the problem

The thing is, yes Facebook and Google's data collection is horrendous, but TikTok it literally on another level.

Quite a good explanation here:

https://www.reddit.com/r/videos/comments/fxgi06/comment/fmuk...

View on HN

Seems not true. I worked in mobile security. We had massive amounts of data about mobile apps and the suspected behaviour they show (via dynamic analysis, static analysis, code signatures, etc) We saw a huge amount of Ad SDKs showing all kinds of malicious behaviour. Facebook etc were the worse, TikTok was not particularly exceptional. One of the biggest problem for an anti malware product in that space is that most "legitimate" software looked indistinguishable from spywares. And if we were to mark these as malware then our product won't be usable.

These apps are hoovering crazy amount of information. They should be banned, universally. No matter which country they originate at. Giving politicians this kind of power over the population in a democratic society is a huge national security risk. No less than a foreign power having these capabilities.

We have newer leaks about data collections that seem genuine but that particular post you've linked to has been debunked. He even promoted a subreddit where he was unable to provide proof for _any_ of his claims. Nothing ever happened. Some things just didn't make any sense like the app making regular http requests. Google doesn't allow that and they haven't allowed it for years. It's literally impossible for that to be the case, for example.

https://www.reddit.com/r/tiktok_reversing/comments/i8gig3/be...

Personally I feel this is as much a failing of of mobile OSs as anything else. As long as we have an environment where ad networks think it's desirable to collect this kind of information it's going to get collected, whether by TikTok or ad networks. Apple at least attempt to limit what data is accessible by apps, Google is less incentivized to do so.

It's not much help to "ban TikTok" while the ad networks run wild. If we're going to be worried about China I doubt it'd be too much trouble for them to place a few engineers into ad networks and exfiltrate the data from there.

Maybe the governments should force mobile OS to provide absolute zero information about anything to apps. If the apps can't get anything they can't leak anything.

As a user I want to have the app as isolated as possible and have the ability to grant it any system permissions I want. Perhaps combined with a store rule that an app isn't allowed to block unrelated functionality when it doesn't get the permissions it wants.

iOS has been quite good to me in this regard, although it still needs improvements (e.g. add a permission for accessing internet).

Unfortunately that approach pretty easily ends up in a territory where you can't do anything interesting with your phone, either, because it's all too dangerous.

Then your phone will be a quite useless device.

The governments are the direct beneficiaries of this data collection either directly or indirectly.

Exactly right. As can be seen via the purchases of large swaths of private location data by the Department of Homeland Security and other government entities, essentially side stepping US citizens’ 4th amendment rights [1].

[1] https://www.aclu.org/news/privacy-technology/new-records-det...

From the link:

- Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)

- Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)

- Everything network-related (ip, local ip, router mac, your mac, wifi access point name)

- Whether or not you're rooted/jailbroken

- Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC

- They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication

The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their...

Not trying to be flippant, but that list just sounds like google play services to me. In fact, I assumed play services collects way more data.

Also, tiktok surely must be collecting some engagement / interaction analytics... That list doesn't seem complete or legitimate.

Or any random debugging library like Crashlytics.

didn't the facebook app do mostly the same?

Interesting! Is this allowed in GDPR?

I would not think any of these points would be ok. You seem to argue that this is something "everyone does", that does not make it ok. I really thought we had gotten further in the privacy discussion.

If GDPR would be enforced, Google, Microsoft, Facebook and other will exit EU market. At the moment GDPR is a joke.

It is being enforced, albeit slowly. The Danish authorities pretty much just banned the use of Google Classroom in the EU -- it's one piece at the time and it takes a long time before people react, considering the decision was made based on the now two year-old Schrems II case.

Do you have a better source? I don't buy the comment at all, and the whitepaper[0] is of very low quality.

[0] https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...

From Reddit:

> Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)

> Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)

> Everything network-related (ip, local ip, router mac, your mac, wifi access point name)

> Whether or not you're rooted/jailbroken

> Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC

> They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication

Wait a minute - Why was Android or iPhone - built by West allows everything... Or if tiktok are the topdog in writing apps and FB missed out on writing these? Sour grapes?

Most of those metrics can be gathered by off the shelf analytics SDKs. Not hardware IDs though. If they are doing that on iOS they are certainly violating a number of rules.

The proxy server is disturbing if true. Only reason I could think of that being necessary would be to use customer devices to perform distributed transcoding of other people's videos. Can't imagine that being something Apple would allow.

I'm sure tiktok does a llt worse since that comment was written, but that list is a tiny subset of what facebook has been caught doing in the past and what microsoft, google and apple do now.

The US government do not hold large corportations to account, quite the opposite. They put people in jail for successfully fighting them legally or turn a blind eye when whistleblowers are car bombed. They make deals with facebook and google for the data so they can say 'it's a private company and independent entity'.

China would likely be just as bad if they were as powerful, but from the point of view of most of the world they have stolen far less of our natural resources, killed/deposed far fewer of our democratically elected governments, bought up far less of our media and turned it into propaganda, spied on our citizens less, and abused treaty law to curtail our freedoms far less.

Reply on news.ycombinator.com