Hacker News Reader

Comment by asynchronous | Hacker News Reader

Gonna back this up, from the security research I’ve read the app *uploads* over 2gb of data once installed over the course of one month, without any interaction at all from the user.

View on HN

What is the data? Doesn't iOS limit access to anything outside of the app? It has to ask to access contacts, photos, location. If you just use it to scroll through stupid videos, what does it even have access to?

IIRC the traffic is encrypted, all TCP/IP packets but going to bytedance servers. Without interacting with the app I have no idea what it could be sending but scary to speculate.

please speculate. I just don't understand what it would even have access to. Are you worried about it exploiting iOS bugs? Otherwise it should only have explicit access to what I grant, right? No audio, video, files, photos, contacts, location.

Right, in theory iOS should sandbox it. But all the other functionality that’s exposed is probably getting sent over (think ip address, connection settings, iOS OS fingerprint). My guess is most of that data is just a keep-alive c2 style connection with ByteDance. Heaven forbid the CCP develops some iOS zero days and then has a list of every single iOS device that would be vulnerable to it.

> Are you worried about it exploiting iOS bugs?

Yes, or gathering information not blocked.

For example, you don't need iOS permission to get general location information (IP address), or device fingerprint.

Everyone here should know it's very easy to bypass any TLS on a device you control and sniff the traffic. if there was some malicious data being sent there's plenty of people to ring the alarm bells: the people reverse engineering the internal API to make bots, the black hats trying to steal user data, the scrapers stealing content,...

This stuff has been talked about often enough that it should be well-documented, but can we have a detailed rundown on the stuff that TikTok does that isn't done by other apps?

I think the issue is: 1. The sheer amount of people it affects 2. The fact that the power resides with the CCP. Not like I trust any countries’ government but the CCP clearly has goals counter to the West’s

But both have goals that are counter to my own, so I'd probably rather give neither the edge.

What does "no interaction" means? Installed it, but never started it? How does it run and collects data in that case?

Source on this, please!

are you referencing something specific?

Where can I find this security research?

Reply on news.ycombinator.com