TikTok is “unacceptable security risk” and should be removed from app stores | Hacker News Reader

TikTok is “unacceptable security risk” and should be removed from app stores

malwarebytes.com

77 pointst2364 comments

FCC: TikTok is unacceptable security risk and should be removed from app stores - https://news.ycombinator.com/item?id=32148218 - July 2022 (848 comments)

FCC commissioner wants TikTok removed from app stores over spying concerns - https://news.ycombinator.com/item?id=31923483 - June 2022 (505 comments)

Can someone tell me what they track that say, google or meta doesn't? I have yet to see anything that is tracked that isn't a part of the internet ad ecosystem invented here in the USA. Yet there's a huge political movement to ban tiktok that seems to center around the idea that the chinese government may be involved. This being a technical forum with a lot of employees from the ad industry here, I'd expect a hell of a lot more data points about what they're taking and why it warrants a ban. Someone please give specifics.

Personally, I always act as though everything about everyone is being taken and that's the world we live in now and there's too much money companies are making for anyone to ever protect the data cow. If the US government wants to prevent this then they have to legislate and make rules that turn off the data spigot to US corporations too.

Exactly, the subtext here is that it's a large adversarial nation state collecting the data, rather than Tik Tok being an exceptional privacy violator, which they are not. Most large tech firms and apps on app stores are just as egregious.

It's not that the idea the Chinese government _could_ be involved. The Chinese government _IS_ involved (as in it's an indubitable fact), this is also true for any other Chinese mainland corporation. Some even are part of the government itself (like Tencent).

If the involvement of a communist dictatorship that's an enemy to the USA having millions of data points on US citizens and it's allies is a problem or not, that's another discussion (IMO yes but I'm willing to hear others opinions on this).

I always think of information warfare. Why bomb another nation when you can use all their private info to destroy their personal life’s. People ask why I’m not worried that the US has the same info, and I am to a degree, but in the current climate I’m more worried about an attack coming from china / Russia then from the US ( I’m from the EU).

Consedering US mined NordStream 1 & 2, you should wory as much about US.

Beside, they are 1 election away from electing Trump and Marjolie Taylor Green as Potus and VP.

Though implied, it’s worth noting specifically: Any traffic that passes through China (for example: companies with servers in China) is gobbled up by the Chinese government.

Whether a company wants to or not, if they have servers in China they are giving all information to the Chinese govt.

CCP has the party member in every company board. American companies has a leash. That's the difference. China is not ur typical democratic country. I wish we could just get over this point.

> American companies has a leash

And what leash is that? The US government is the prime example of what happens when corporate money enters politics. There are only two parties and both of them serve the interests of capital. The US doesn't even break up monopolies or cartels anymore.

https://en.wikipedia.org/wiki/Regulatory_capture#United_Stat...

How does that invalid my points of China's companies and US companies are not at the same level? Yeah America bad it's not that effective I totally agree with you. Let me rephrase it this way, if you think Google/Meta (which I agree), China companies are much worse. Democratic countries have many problems. But please stop comparing them to the countries like China. There are levels.

You said US companies have a leash, even though US is the prime example of corporate control of government.

Companies are the same all over the world, their job is to maximize their value to investors by any means necessary. That's as true in China as it is in the US, so there's no difference.

When it comes to government, neither US nor China has any effective democratic controls on corporations. China has only one party which controls companies with authority, and the US has two parties which both represent the companies themselves.

Here we go again. Yes, I agree with u on us on every point in isolation. But they r not at the same level. They are NOT the same. U cant just nihilisitically put them together. If u don't know how CCP operates, how china companies r just direct extension of CCP where party members have would directly inject themselves into the companies, go read some materials first. There no private companies in the US/EU sense in China. I am not here to teach the basics and not intersted the equal bad debate. And not replying to this person any more

> how china companies r just direct extension of CCP where party members have would directly inject themselves into the companies, go read some materials first. There no private companies in the US/EU sense in China

That's not true. In China private companies exist and can largely operate freely. China is a capitalist country. The only thing that limits corporations in China more than the US is that the companies and billionaires in China are expected to fall in line and not rock the boat when it comes to CCP. But this does not make the corporations an extension of the party, they're still privately owned and operated corporations working within a capitalist market system.

When it comes to government elites injecting themselves to the companies, that's not at all unique to China. The revolving door between government, lobbying groups, think tanks and corporations is "business as usual" in the US and EU too.

China has the power relations between govt<->corporations reversed. In US, the government elite is expected to fall in line with the capital owners, and in China it's the other way around. That's the main difference, not whether the corporations are vaguely "good", "bad", "worse" or "better". That's just simplistic and vague "china bad" rhetoric. The corporations themselves work within the same framework of capitalism, i.e. maximizing value for shareholders.

I will dismiss the personal attacks, as they are not constructive.

> Personally, I always act as though everything about everyone is being taken and that's the world we live in now and there's too much money companies are making for anyone to ever protect the data cow. If the US government wants to prevent this then they have to legislate and make rules that turn off the data spigot to US corporations too.

That should also include giant fines for privacy violations for all companies who want to operate in the US or the EU and the fines should be in the billions of dollars.

Given that Facebook got a $5BN massive fine from the FTC for violating the privacy of their users and Google repeatedly getting fined for privacy violations in the EU nearing in the billions of euros, then TikTok should most certainly be fined in the multi-billions for all these privacy violations in [0], [1], [2] and [3].

[0] https://futurism.com/tiktok-spy-locations-specific-americans

[1] https://techcrunch.com/2021/06/03/tiktok-just-gave-itself-pe...

[2] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

[3] https://www.bbc.co.uk/news/business-63494951

Not a single one of your links relates to a privacy "violation" though. Once again, I'm asking someone to tell me what they take that Google and Meta don't.

The problem is that certain organizations can harvest recordings of illegal or semi-legal activities (think a teenager sharing a video with her crush, etc) and then five-ten years down the line that content can be used as a blackmail to do industrial espionage, sabotage, etc.

China is an autocracy. Even if it is not doing it already it can easily start doing it in the near future. One can look at the example of another neighboring autocracy and see where the trajectory could lead.

Google and Meta track for the US Government though, TikTok tracks for the CCP. That's literally it. That's the difference.

Big Tech is part of the government surveillance apparatus. The reason Russia and China don't want Google and FB having a foothold in their countries is the same reason the US doesn't want TikTok to have a foothold here.

In light of these revelations and in deference to national security, I am going to have to stop making twerking videos on their platform.

> I am requesting that you apply the plain text of your app store policies to TikTok and remove it from your app stores for failure to abide by those terms.

I hadn't thought of this point before. Apple and Google both reject apps from small-time American developers all the time for minor technicalities related to their data privacy rules. Why does ByteDance get to run roughshod over all of the same rules?

Apple/Google get to decide themselves who stays and who doesn’t; one of them cannot remove TikTok because everyone will flock to the other side. And money; TikTok is one of the few apps that makes money, lot’s of it. I don’t know or use it, but I assume Apple and Google benefit from that.

> one of them cannot remove TikTok because everyone will flock to the other side

Not if they both did it at once.

As if either Google or Apple cares about privacy.

What's in it for Apple? End up with pissed off users, probably brand damage in China, so that an ad network they don't compete with, but Google does, is crushed? And if Google allows it back on their store or just people publicize how to sideload, it could even cause a few super fans to switch platforms to android.

> one of them cannot remove TikTok because everyone will flock to the other side.

If Google did it, for sure, and then everyone shares how to side-load on Android.

If Apple did it, I'm pretty sure you get a whole lot of complaints but little action.

Apple's lack of ability to side-load or have alternate app-stores, plus their lock-in for the rest of their ecosystem makes that barrier to switching a lot higher.

I think Apple would have to do something a lot bigger than banning TikTok to get a critical-mass to move off Apple devices.

One of the larger messaging services perhaps - WhatsApp or Telegram or whatever's big in various regions might do it.

Your question was probably rhetorical, but I'll answer it anyways: TikTok's userbase and revenue generation are massive.

It will be extremely costly for Google or Apple to remove TikTok simply because of its massive fanbase of everyday users - remove TikTok and you get millions of pissed off users, and for what?

Those users didn't care that their data was being harvested anyways (any cursory Google search will reveal TikTok's data harvesting policies), they care about the the fun app that they love spending hours on everyday, and now the tyrants at Apple and Google are taking their fun away.

You’re right. But I wonder what would happen if both did it simultaneously.

Everyone learns how to sideload apps.

Nah, not on iPhones they don’t. Barrier to entry (and risk of breaking their phone) of jail breaking is too high for ~99% of iPhone users.

Android might be a different story. But not THAT different. People REALLY rely on app stores.

> (and risk of breaking their phone) of jail breaking is too high for ~99% of iPhone users.

really 99%, you have the data backing that up? At any rate my baseless assumption is that TikTok is mainly younger users, I bet for people who do not have their phone from work or purchased themselves from having a job i.e kids and teens, the risk of jail breaking is minimal - at least the first time.

on edit: assume the preceding in a jocular tone.

Didn’t happen with Epic before I think

OK, I just know that if something my daughter wanted on her phone or computer was no longer available through normal ways she would figure out the other ways to get it and wouldn't care about the cost, because hey that's not her problem that's my problem.

World productivity increases 3-5%

Also when people use a mobile app frequently, it increases their chances of interacting with other services in your ecosystem more often, e.g. making purchases, viewing ads, etc. Banning TikTok reduces the need of taking out the phone frequently during the day for many people.

The apple v epic saga has lead to the same result. Epic pulled fortnite from the appstore and blamed apple for taking all their money. Now the kids are mad at apple for inciting the removal of their favorite game.

Are they really though? Did the iPhone share among young people decline significantly afterwards?

Well, that was my point. After 3 months everyone had forgot about it.

Ah sorry that’s a misunderstanding then

Conspiracy theory: I would not be surprised at all if Meta were behind at least some of the efforts to get TikTok banned. After all, if you’re bleeding users to the competition, what better way to win than to relentlessly slander the competition? It doesn’t even much matter if they succeed in getting them banned - sowing FUD about the app is a great first step to peeling off users.

Hot take: Meta and Twitter and all the rest aren’t any better. They’re just as unregulated, just as willing to abuse private data, and just as willing to cooperate with governments - not just the US.

It's not a conspiracy theory: https://www.washingtonpost.com/technology/2022/03/30/faceboo...

Very "not" surprising.

Exhibits (a) "Chinese parent company, ByteDance, planned to spy on the physical locations of specific American citizens using the popular video app's location data" https://futurism.com/tiktok-spy-locations-specific-americans

(b) "More than 50 overseas police stations are operating in Toronto." https://www.theglobeandmail.com/politics/article-chinese-pol...

The headline is misleading. One of the five FCC commissioners said this, not “the FCC” as suggested by the headline, and in the same interview that commissioner said “as an FCC official, his own capacity to regulate TikTok is limited; CFIUS, the Commerce Department or the Federal Trade Commission may have greater legal authority over the company” and “he has not met with CFIUS member agencies or the White House to specifically raise the issue”. See https://www.cnn.com/2022/11/02/tech/fcc-commissioner-tiktok-....

It’s a guy thinking out loud. He’s an important guy, but on it’s own this changes nothing.

The whole premise that it collects "everything" is FUD and inaccurate:

--- TikTok is said to collect "everything", from search and browsing histories; keystroke patterns; biometric identifiers—including faceprints, something that might be used in "unrelated facial recognition technology", and voiceprints—location data; draft messages; metadata; and data stored on the clipboard, including text, images, and videos. ---

None of this can be captured due to app sandboxing on any up-to-date mobile OS. The only one that might have been possible in the past is "data stored on the clipboard" (like many other apps) and even that is not possible anymore since iOS 16 beefed up security there (requires permission).

people didn't listen to warnings against using Zoom whose actions suggest massive incompetence at best and malice at worst. Even government officials have continued to use it. I doubt many people will take the commissioner of the FCC's warnings any more seriously.

People will continue to do whatever is most convenient for them no matter how much harm they risk in the process. The more abstract and delayed that harm is the less they will care until they are bit square in the ass by it personally, and even then some people don't learn their lesson the first time. Corporations will simply do whatever makes them the most money no matter who it hurts.

One reason to buy some Meta stocks is that there's a decent chance of a ban on TikTok in western countries.

The anti-China, anti-TikTok sentiment is growing. In addition, Meta directly funds negative TikTok PR.

Bytedance lost Russia

If they lose the US too thats a significant part of the world, and US action will lead to many other countries replicating the US action

But one said "TikTok is the best thing to have happened to the Internet." [0]

Well, I don't think so. It is the exact opposite of that [1] [2] [3] [4] [5]

[0] https://news.ycombinator.com/item?id=28135484

[1] https://www.nrk.no/osloogviken/xl/tiktok-doesn_t-show-the-wa...

[2] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

[3] https://techcrunch.com/2021/06/03/tiktok-just-gave-itself-pe...

[4] https://techcrunch.com/2021/10/26/tiktok-dodges-questions-ab...

[5] https://futurism.com/tiktok-spy-locations-specific-americans

App stores are a free market. If users don't want to risk their security, they can simply not download the app. On average, the invisible hand of the market and the wisdom of the crowds will choose the best option. If we can't trust markets to work these things out, what can we trust them with?

I am not an economy expert but I believe we don’t really have free markets in our societies. We have to control the markets slightly, otherwise it would be a mess.

Yeah right? If people don't want viruses, just don't download them!

My point is that ordinary people don't know that TikTok could be even remotely bad for them, and when they do know, they will think that it is not that dangerous.

And Apple/Google dialogues about data transfer and all that will be dismissed by the user the second its pop-ups.

The user I am describing above is "the crowds". That's why TikTok is so massively used even though their security problems.

Isn't the onus on the user to assume risk? If they wish to have an accurate perspective then they have ever opportunity to do so. Sorry, if the contrary is true, and markets don't result in the best of all possible worlds then we have to conclude that free market capitalism is not going to work. The two are inexorably yoked together.

Just make the data collection itself illegal. Completely and without exceptions. Then ban all apps that don't follow the rules.

Everything else is completely hypocritical when there's not a single big US social media app that doesn't do the exact same things.

As if the fb+messenger+ig+whatsapp circle was not problematic

This is a conflict between the “customer is always right” mentality among US corporations and claims by a single FCC commissioner—not he entire board. And consumers have spoken by adopting TikTok in big way. Unless many other government officials decide to intervene, Apple/Google won’t do anything. The Biden Administration has been proactive in challenging China in many ways (eg the recent actions on chip companies and employees). But they have chosen to not touch TikTok, possibly bc they recognize they TikTok is far more popular than any politician, Republican or Democrat.

Trump already attempted to ban TikTok in 2020, but he backed down.

Besides the direct security concerns, giving the CCP such access to the hearts and minds of America's youth does seem like a risk to me.

I am a late comer to TikTok (was curious after a recently reported news article on the potential booting/sale of TikTok back in the Trump days). All it shows me is large breasted women and “crystal polishers” (which I never knew was a thing). Everyone uses fake names - it’s not like Facebook where people offer up their real stuff. I’m kinda confused around where the security problems are.

Have you seen the list of permissions it requests?

The fake names on TT are not what is the risk. Its the HUGE amoumt of metadata collected by the app and the opaque nature of its storage and permanence.

As opposed to the responsible parties of Meta and Google?

Yes I don't trust these companies, but I sure as hell trust them more than Bytedance or the Chinese government. The amount of whataboutism in this thread.. Do we have a lot of Bytedance employees on hn?

Those are also bad? Why TT is being talked about is that the bullshit Facebook and Google pull is normalised now so people don't talk about it as much.

> All it shows me is large breasted women and “crystal polishers” (which I never knew was a thing)

It shows me an endless stream of cute kittens. It's amazing.

I'm also confused by the security risks listed, I just checked the iOS privacy report that shows which sensors and data apps used, and TikTok is not even on the list. I'm also struggling to understand things listed in the article such as it accessing texts on the device(?) - like... it can't do that, at least not on an iPhone. As far as "voiceprints" and "faceprints" do they mean it video/audio content can be uploaded to it? Like thousand other apps?

If anything there should be an argument that by default the apps should be better sandboxed and permissions to be an explicit opt-in, this current approach just seems like fearmongering.

Same here. I’m wondering. Is this an Android issue maybe?

TikTok is well-known for using vulnerabilities to access more personally identifying data than it should from users [0], such as MAC addresses [1] and IMEI numbers for the SIM cards.

[0]: https://theforestscout.com/35101/in-lfhs/tiktok-app-comes-wi...

[1]: https://www.wsj.com/articles/tiktok-tracked-user-data-using-...

Much more reasonable reason to remove that trash from all stores is that it leads to mental and intellectual degradation and often generates hardly endurable levels of cringe.

Reply on news.ycombinator.com