this post was submitted on 09 May 2024
467 points (99.2% liked)
Technology
59416 readers
2765 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I'm so glad we banned tik tok so my data doesn't fall in the wrong hands.
I know you're being flippant, but it's worth noting that there is a considerable difference between a company getting hacked like this and an app with unfettered access to the cluster to sensors that we've got in our pockets.
Yeah, hackers having my data is so much better than China....
The thing with tik tok isn't only with the data China can gather from US residents. It's also how they can use that information to influence the populace and send them propaganda, for example influencing the election results.
They can also gather information about our politicians who use it and blackmail them to get what they want
Yep. But I guess it was already banned on government phones right? (not from the US, so I'm not all that up to date....)
Yeah but our politicians have personal phones and computers too
Ok, what information could they gather and how would they use that to influence an election?
The section Methods on the Cambridge Analytica wiki page explains it pretty well. While it's not proven to be able to directly influence voting, it's effective at swaying people's opinions and emotions about subjects.
So it's all bullshit then, got it.
The ban is a dumb policy, but you’re daft if you think the security implications are at all similar.
TikTok was caught injecting a keylogger into their in-app browser and their response was “Well yeah, but we promise we’re not using it.”
doesent literraly every website with autocomplete search queries do this?
No. This is analogous to cross-frame scripting.
So imagine you go to
tiktok.comand you click on a link tobestbuy.com/cool-product-i-want-to-buy. But instead of taking you directly tobestbuy.com/cool-product-i-want-to-buy, it keeps you ontiktok.comand just opens an iframe with a keylogger injected into it.So then when you enter credit card info into the
bestbuy.comUI, thetiktok.comJS can see what you typed.(This scenario is largely impossible these days, due to modern browser security.)
The difference is that if you witnessed this kind of XFS in your desktop browser, you might notice it because the location bar still says
tiktok.com, because you never actually left the site. But in a mobile in-app browser, you don't need an iframe. You can inject JS directly into the browser itself, making it invisible to the user. As far as you can tell, you're on regular ol'bestbuy.com, not a modified version of it.bruh
lmao, you asked.
I'm not a security expert, but my tech career has involved a lot of automated testing in weird scenarios, including iframe-based Facebook games and browser-based mobile apps. Automated tests face a lot of the same challenges that a malicious third-party would, so I know a little bit about how to get past them -- or rather, how to deliberately create vulnerabilities (in the dev build of your system) so that your tests can get past them.
Edit: I am curious why someone downvoted me on that one though. I can understand how my comment about the ban being dumb but TikTok also shipping a keylogger could anger people on one side or the other. But just explaining how in-app browsers revive a security problem that's been long-solved in standalone browsers?