> I'm getting a lot of DM's asking me to prove the majority of this with a paper and snippets of the offending code. I have a decent amount of my notes on my other laptop that recently had a motherboard failure and the majority of that data is on the laptop's SSD. It's a macbook pro, so recovering the data isn't exactly super simple. I have some frida scripts that I pushed to my git server as well as some markdown files + conversation logs I've had with exploit devs, but not much else. In order to get everyone the proof they require, I'll likely need to reverse the app all over again which isn't something I have time for right now.
That sounds like "dog ate my homework", but well, sh*t may happens.
> Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)
What so special about it?
> Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)
That interesting indeed. I heard some developers did that as well (Uber-Lift case ?) but it really strange that Android enables that. I'm not an Android dev, but I guess you can retrieve that through PackageManager?
> Everything network-related (ip, local ip, router mac, your mac, wifi access point name)
https://developer.android.com/reference/android/net/wifi/Wif...
wifiManager.getConnectionInfo()
> Whether or not you're rooted/jailbroken
My bank app does the same as well as plenty of other apps. Again, I mostly iOS guy, so not familiar with Android ecosystem that well.
> They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication
That sucks. Can anyone explain why they do that?
> On top of all of the above, they weren't even using HTTPS for the longest time. They leaked users' email addresses in their HTTP REST API, as well as their secondary emails used for password resets
Bold statement without any facts, tbh.
I don't wanna play devil's advocate and I don't support CCP or a big fan of TikTok.
I really enjoy reading well-made security research that unveil security valuation in Chinese app. [0]
But hardly rely on the posts without clear any data reinforcement
In this particular case, I think it's because the person who apparently discovered it claims that other apps "don't collect anywhere near the same amount of data that TikTok does". [0]
> For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare.
[0] https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...