News for hackers. Stuff that matters.

A comment on FCC: TikTok is unacceptable security risk and should be removed from app stores. Parent comment

Re:FCC: TikTok is unacceptable security risk and should be r... by soganess on Tuesday July 19, 2022 @03:37AM (#32148595)
From the link:

*

- Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)

- Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)

- Everything network-related (ip, local ip, router mac, your mac, wifi access point name)

- Whether or not you're rooted/jailbroken

- Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC

- They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication

The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their...

*

Not trying to be flippant, but that list just sounds like google play services to me. In fact, I assumed play services collects way more data.

Also, tiktok surely must be collecting some engagement / interaction analytics... That list doesn't seem complete or legitimate.

[ Parent | on HN ]
Re:FCC: TikTok is unacceptable security risk and should be r... by sofixa on Tuesday July 19, 2022 @03:52AM (#32148695)
Or any random debugging library like Crashlytics.
[ Parent | on HN ]
Re:FCC: TikTok is unacceptable security risk and should be r... by andruby on Tuesday July 19, 2022 @04:34AM (#32148955)
didn't the facebook app do mostly the same?
[ Parent | on HN ]
Re:FCC: TikTok is unacceptable security risk and should be r... by pastage on Tuesday July 19, 2022 @04:45AM (#32149039)
Interesting! Is this allowed in GDPR?

I would not think any of these points would be ok. You seem to argue that this is something "everyone does", that does not make it ok. I really thought we had gotten further in the privacy discussion.

[ Parent | on HN ]
Re:FCC: TikTok is unacceptable security risk and should be r... by hulitu on Tuesday July 19, 2022 @05:51AM (#32149439)
If GDPR would be enforced, Google, Microsoft, Facebook and other will exit EU market. At the moment GDPR is a joke.
[ Parent | on HN ]
Re:FCC: TikTok is unacceptable security risk and should be r... by 2000UltraDeluxe on Tuesday July 19, 2022 @08:19AM (#32150458)
It is being enforced, albeit slowly. The Danish authorities pretty much just banned the use of Google Classroom in the EU -- it's one piece at the time and it takes a long time before people react, considering the decision was made based on the now two year-old Schrems II case.
[ Parent | on HN ]