Hacker News Reader

Comment by vFunct | Hacker News Reader

What kind of data would a native app collect that the web wouldn’t? Seems like all the important advertiser-relevant demographic data is in the user account itself, not the platform. Whether you’re interested in snowmobiles or baby diapers would show up in both web and native apps via your user account?

Also what technical limitations remain in web apps that limit use? WebGPU seems like it can handle most video pixel processing functions that native apps need and websites can be installed easily.

View on HN

- start on device boot

- list of contacts / address book

- GPS location (browser can access location too if given permission ofc)

- list of devices accessible on local network (if tiktok really is a malware vector this would be a great way to scan users' homes for vulnerable IoT devices)

- list of other apps installed on device

Advertisers aren't just interested in bucketing you based off headline demographics like what videos you watch, they bucket you with people who have similar behaviors and extrapolate that you will like what they like, so they'll take as many dimensions as they can get to find similarities in behavior.

The user fingerprinting is also used to identify you on devices you're not logging in on.

> - list of other apps installed on device

Is there are an API for that on iOS?

I thought so but apparently it was patched long ago [0]. Still there on android, tho you’re meant to fall under a set of valid use cases or risk rejection. [1]

[0] https://github.com/danielamitay/iHasApp

[1] https://support.google.com/googleplay/android-developer/answ...

> - start on device boot

Don't think it's possible on iOS, and I'm doubtful TikTok does this even if it were possible on Android.

> - GPS location (browser can access location too if given permission ofc)

Actually this AND all of the other fingerprinting methods you listed also require user permission managed by the mobile OS (iOS/Android).

In effect there is nothing a 'native' app can get without user knowledge/consent that a web app could not. If there is, it should be considered a bug for mobile OS providers to fix.

What about a background data refresh task running and the server geolocating the IP making the request? The accuracy would vary but you could still get reasonably close to assuming someone's nearest city.

Background data refresh is reasonably safe to assume everyone has turned on...

It’s not collecting data for advertising reasons; it’s a CCP operated malware vector.

Where's the evidence?

Porque no los dos

Reply on news.ycombinator.com