Hacker News Reader

Comment by sdan | Hacker News Reader

Was taking a look at what pings this website was sending (this is probably the first time I've ever been on tiktok.com)

Sent some pings to:

http://byteoversea.com/ http://ibytedtos.com/

Not sure what either of them are for sure, but from first look it seems like both are monitoring scripts (see https://sf16-muse-va.ibytedtos.com/obj/ttfe-maliva/slardar/p...) , but will do a deep dive soon. Interesting they need this just for a simple press release.

Also notice the person posting is explicitly from "TikTok US" and not just "TikTok". Interesting decision.

View on HN

note that bytedance is the owner of TikTok, so while these may be trackers, it's no more nefarious than youtube hosting some resources on gstatic.com.

They're not sending info to random third parties, they're sending info to themselves.

Pretty sure most company blogs also have analytics scripts.

They are a Chinese company so they obviously are not going to use Google Analytics...

Also if you root your Android phone, wireshark their app, trace the traffic, and check the Manifest you'll see they are sending user's personal identifiers (non-resettable hardware IDs) to servers in China. There's absolutely no way why uploading this data (or reading it in the first place) would be in any way necessary to provide the app's functionality.

And they dump/read files in shared storage spaces to cross-tracking with other Chinese apps. If you try to install it into Secure Folder on Samsung it gets disabled.

To do exactly what they say in the post. Associate alt accounts with a main account that has been banned.

No, it's still not ok to track hardware IDs even (especially) for that reason: https://developer.android.com/training/articles/user-data-id...

How else would you do the tracking?

The most damning thing your link says is that it's not a best practice.

The best fit is probably the "Anti-fraud: Enforcing free content limits and detecting Sybil attacks" use case, since that is about preventing a single user from creating multiple accounts. (Although the content limit for a banned account is to stop it from producing more content, not consuming it.)

The official recommendation:

Use: Instance ID or GUID. On Android 8.0 (API level 26) and higher, SSAID is also an option, as it's scoped to the app-signing key.

Why this recommendation?

Using a GUID or Instance ID forces the user to reinstall the app in order to circumvent the content limits, which is a sufficient burden to deter most people. If this isn't sufficient protection, Android provides a DRM API, which can be used to limit access to content, includes a per-APK identifier, the Widevine ID.

So I guess best practice in this case means they should use DRM instead.

Most analytics function isn’t necessary to provide the app’s functionality, and yet it’s very common to have it.

Reply on news.ycombinator.com