News for hackers. Stuff that matters.
Re:US to ban transactions with ByteDance and WeChat in 45 days by krn on Friday August 07, 2020 @04:11AM (#24079545)
> if the US creates a precedent for "national security" in this way

It can be a real threat to national security[1]:

> Thursday's order alleges that TikTok "automatically captures vast swaths of information from its users," such as location data and browsing and search histories, which "threatens to allow the Chinese Communist Party access to Americans' personal and proprietary information -- potentially allowing China to track the locations of Federal employees and contractors, build dossiers of personal information for blackmail, and conduct corporate espionage."

It has nothing to do with other Western nations. It's about protecting your citizens from aggressive foreign states that operate based on completely different values.

I would consider going even further, and banning all Chinese researchers from the top US schools[2]:

> Seventy-one institutions, including many of the most prestigious medical schools in the United States, are now investigating 180 individual cases involving potential theft of intellectual property.

> Almost all of the incidents they uncovered and that are under investigation involve scientists of Chinese descent, including naturalized American citizens, allegedly stealing for China.

[1] https://www.cnn.com/2020/08/06/politics/trump-executive-orde...

[2] https://www.nytimes.com/2019/11/04/health/china-nih-scientis...

Re:US to ban transactions with ByteDance and WeChat in 45 days by CameronNemo on Friday August 07, 2020 @04:15AM (#24079581)
The source you linked contains no concrete evidence that TikTok poses a greater risk to national security than similar US based social networks.
Re:US to ban transactions with ByteDance and WeChat in 45 days by krn on Friday August 07, 2020 @05:03AM (#24079887)
How can "similar US based social networks" pose a national security risk to the US?

They might pose a national security risk to China. And that's why all the US-based social networks are banned in China.

Also, the US intelligence agencies could have just validated these public claims by themselves[1]:

> For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare.

And the US and India are not the only countries with deep concerns here. The investigations into TikTok's data collection practices have also been launched by the governments of Australia, Japan, Turkey, Indonesia, Pakistan, and the EU[2].

[1] https://old.reddit.com/r/videos/comments/fxgi06/not_new_news...

[2] https://www.washingtonpost.com/world/2020/08/03/its-not-just...

Re:US to ban transactions with ByteDance and WeChat in 45 days by xvector on Friday August 07, 2020 @08:47AM (#24081238)
None of your sources provide any concrete evidence. Right now all you’ve linked to is xenophobic fearmongering unsupported by any data whatsoever.

Show me the Frida or Wireshark logs showing that TikTok collects more than, say Facebook. Link to actual evidence that China uses it to spy on Americans.

Re:US to ban transactions with ByteDance and WeChat in 45 days by krn on Friday August 07, 2020 @09:49AM (#24081746)
> None of your sources provide any concrete evidence.

> Link to actual evidence that China uses it to spy on Americans.

That's not how national intelligence works, I'm afraid. The actual evidence is often provided only to the decision makers, and not to the general population.

And even if TikTok wasn't doing anything wrong at the moment, the risk assessment might have concluded, that it could technically turn into a national security nightmare overnight.

Re:US to ban transactions with ByteDance and WeChat in 45 days by floatboth on Friday August 07, 2020 @10:50AM (#24082466)
Yeah, national stupidity works by giving ridiculous power to tech illiterate people that don't even know how Android and iOS sandboxes and permissions work.
Re:US to ban transactions with ByteDance and WeChat in 45 days by krn on Friday August 07, 2020 @01:17PM (#24084291)
Are you arguing that the national intelligence agencies of the US are incapable to properly assess technical national security risks?

Or that it is completely impossible that any widely distributed proprietary software developed in China could pose any national security risks?

Re:US to ban transactions with ByteDance and WeChat in 45 days by hackernewsconvo on Friday August 07, 2020 @02:48PM (#24085207)
I think they're arguing that on modern iOS and android the application sandboxing and permissions make a lot of the data collection described improbable/impossible.
Re:US to ban transactions with ByteDance and WeChat in 45 days by krn on Saturday August 08, 2020 @01:03PM (#24093171)
There is a huge difference between "improbable" and "impossible" here.

Was it highly improbable that Saudi crown prince could hack into Bezos's iPhone? Yes, it was. Nevertheless, that's exactly what happened[1].

Now imagine what Chinese government could do with TikTok.

Also, application sandboxing and permissions can mean nothing at all[2]:

> A billion or more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week.

> The vulnerabilities can be exploited when a target downloads a video or other content that’s rendered by the chip. Targets can also be attacked by installing malicious apps that require no permissions at all.

> From there, attackers can monitor locations and listen to nearby audio in real time and exfiltrate photos and videos. Exploits also make it possible to render the phone completely unresponsive. Infections can be hidden from the operating system in a way that makes disinfecting difficult.

[1] https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hac...

[2] https://arstechnica.com/information-technology/2020/08/snapd...

Re:US to ban transactions with ByteDance and WeChat in 45 days by asa4akj on Friday August 07, 2020 @05:33AM (#24080085)
they pose smaller risk, as they sell data to china. But that can simply be outlawed with something like GDPR, without a big drama, unlike a ban
Re:US to ban transactions with ByteDance and WeChat in 45 days by villahousut on Friday August 07, 2020 @04:16AM (#24079587)
I'm using Tiktok on my iPhone and I can't even find an option to allow access to my location? I'm pretty sure any Apps can't access my browsers or search history either..?
Re:US to ban transactions with ByteDance and WeChat in 45 days by asa4akj on Friday August 07, 2020 @05:32AM (#24080077)
iPhone is a locked device. Nothing stops apple from actually not giving you that option for particular apps and you would know nothing about it.
Re:US to ban transactions with ByteDance and WeChat in 45 days by readme on Friday August 07, 2020 @04:21AM (#24079628)
bingo

not a lot of people are indoctrinated into the world of national security, and because of that they just balk at it

there's a lot going on in the world, and it's not a big happy place where everyone are friends, to put it bluntly

china has other motives, I think a quick google should at least clue one in their corporate espionage activities

Re:US to ban transactions with ByteDance and WeChat in 45 days by pjc50 on Friday August 07, 2020 @05:15AM (#24079957)
> indoctrinated

This is not normally a word with positive connotations.

Because the US is a free speech country, people can be aware that quite a lot of stuff done in the name of national security, especially since 9/11, is highly questionable. And the current administration has its own national security questions to answer relating to Russia.

Re:US to ban transactions with ByteDance and WeChat in 45 days by krn on Friday August 07, 2020 @05:13AM (#24079942)
It is not the first time I am surprised by the complete unawareness of the world of national security in the US tech industry:

https://news.ycombinator.com/item?id=18655803

Re:US to ban transactions with ByteDance and WeChat in 45 days by not_that_jeff on Saturday August 08, 2020 @10:32AM (#24091873)
if you believe that story, I believe you dont have the competency to work on a tech job. Go read some book in electronic engineering.