←back to thread

Reverse engineering the obfuscated TikTok VM

(github.com)
412 points xfeeefeee | 2 comments | 21 Apr 25 01:59 UTC | HN request time: 0.413s | source
Show context
heinternets ◴[21 Apr 25 07:08 UTC] No.43749139[source]▶
Is TikTok so obfuscated to prevent people from knowing the full extent of data collection and device fingerprinting?
replies(1): >>43751909 #
gruez ◴[21 Apr 25 13:39 UTC] No.43751909[source]▶
1. Practically speaking all this javascript fingerprinting pales in comparison to what native apps have access to. Most people aren't using tiktok on their browsers, and the browser version heavily pushes you to using the app, so you should be far more worried about whatever's happening in the app.

2. Despite tiktok having a giant target painted on its back for its perceived connections to the CCP, I haven't really seen any evidence that it does any more tracking/fingerprinting that most other websites (eg. facebook) or security services (eg. cloudflare or recaptcha) already do.

replies(1): >>43752102 #
1. nicce ◴[21 Apr 25 13:59 UTC] No.43752102[source]▶
> 2. Despite tiktok having a giant target painted on its back for its perceived connections to the CCP, I haven't really seen any evidence that it does any more tracking/fingerprinting that most other websites (eg. facebook) or security services (eg. cloudflare or recaptcha) already do.

Take a look for request parameters in TikTok vs. Instagram for example.

Every request for TikTok forces you to pass most of the information that browser can collect from the end-user before server responds:

https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

replies(1): >>43752371 #
2. gruez ◴[21 Apr 25 14:24 UTC] No.43752371[source]▶
>Every request for TikTok forces you to pass most of the information that browser can collect from the end-user before server responds:

Half of the parameters are stuff relating to the app itself, or could be inferred from other sources like user-agent. The other fingerprinting stuff (eg. canvas or webgl fingerprinting) is basically industry standard and by no means unique to tiktok. Even the claim that "browser can collect from the end-user before server responds" doesn't hold up to scrutiny, because there's no meaningful difference between that, and browser check interstitials (eg. the cloudflare checkbox), which fingerprint you before letting you access the content. It's also unclear how that's more sinister than the alternative approach of sending telemetry/fingerprinting data to a separate endpoint.