Hacker News Reader

Comment by madeofpalk | Hacker News Reader

Tiktok does the same thing when you get a URL to share a video

It’s really creepy too if you don’t know the share url can leak your account name (if you were trying to keep that private)

It is but try to explain this to a regular user and they will call you a tinfoil hat nerd

I don’t think this is that big of a problem today, after so many privacy leaks people are a bit more aware, at least in my experience. Also tiktok actually shows a popup that the link contains information about your account.

Ya, most people get that there is no privacy. Where I think you get more of the "tinfoil hat" accusations is that a lot of people don't care or don't recognize the far reaching implications of lack of privacy.

In my experience most people do understand the basic structure of a URL even if they don't know the proper names for the parts. It doesn't take being a software developer to empirically figure out which parameters are responsible for tracking and delete them before sharing — especially if you see your own username in one of them.

Do “regular folk” really do this though? It is a serious, non provocative question. I strip all cruft off URLs but consider myself privacy aware and technically adept. I don’t think my non-technical friends have any idea about this.

Take a look at the URL you get when you try and share a tiktok video, and tell me which part to delete to remove the tracking

You have to visit it yourself to resolve it to a long link, then you'll get a long URL that has /@username-of-uploader/videos/[video id]?[huge amount of tracking variables]. For now, you're ok with dropping everything after the ? after you resolve out the vm.tiktok.com link shortener.

Not that it makes it any less shitty but you can disable that behaviour in the settings

Until that setting dissapears when things get suffled up after an update or something like that.

I actually had no idea that was an option.

Just to add some clarity, it's not that it "can leak" your account name, it deliberately pops up your account name and profile photo above the video to anyone that clicks the link.

ByteDance has done a really good job making me reconsider whether I’d ever work for Big Tech again.

I have some serious reservations about social media generally, which is why I left to begin with, but between TikTok and Instagram I know hands down who I trust more.

What’s your exact concern with TikTok?

Not sure if this is theirs, but [1]:

> “Everything is seen in China,” said a member of TikTok’s Trust and Safety department in a September 2021 meeting. In another September meeting, a director referred to one Beijing-based engineer as a “Master Admin” who “has access to everything.” (While many employees introduced themselves by name and title in the recordings, BuzzFeed News is not naming anyone to protect their privacy.)

[1] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

Why is this linked to “big tech”? Big tech usually means FAANG which is American when you point out an issue with information going to China.

Sorry I'm not the person who wrote that comment, so I don't know if this is what they were thinking, it was just a guess. It is confusing for me what they meant too.

This sort of nationalism is not useful; when pattern of life data is used to quietly blackmail or extort you it doesn't really matter whether it's your own or a foreign government doing it.

I would disagree here. The incentives are quite different, as there are many foreign governments who are actively hostile and use the internet for extremely effective psyops. Social media is the #1 place for psyops with great success.

> The incentives are quite different, as there are many foreign governments who are actively hostile and use the internet for extremely effective psyops.

How does this differentiate them from domestic governments exactly?

For obvious reasons: they want to disrupt society, drop placement in the world, cause internal fractions that divert attention abroad to domestic strive, actively harm populations by spreading dangerous information, move fringes into the center to replace those who are effective with those who are not, cause macro economic harm, replace narratives of foreign adversaries to make them seem friendly or sow doubt that they are in fact doing bad things, rewrite narratives with their value systems instead, destabilize countries and cause civil war, cast doubt on things like democracy to shift the world to autocratic rule, etc etc.

Your question is phrased in a way that would be exactly the kinds of things that foreign adversaries want to achieve online: make people hate their local government so they throw their baby out with the bath water, meanwhile the foreign adversary keeps power with an iron fist and censorship so they don’t suffer the same consequences.

> For obvious reasons: they want to disrupt society, drop placement in the world, cause internal fractions that divert attention abroad to domestic strive, actively harm populations by spreading dangerous information,

Dd we really need foreign governments for this? They do it, but we get plenty of it right here at home. Covid made that plain enough, but so have decades of attacks on education and the middle class. In the US we even have government investigations into our own government for wanting to destabilize the country, cast doubt on our democracy and promote civil war.

I'm not saying foreign governments don't play these kinds of games too, but if pointing out my own nations very real problems and deficiencies makes me sound like foreign adversaries maybe those foreign governments aren't the biggest problem we have and we'd be better served cleaning house and looking at the problems within before pointing fingers at folks outside.

First of all, why would you want additional malfeasance? This is indefensible. It’s like saying with all the police shootings, who cares if foreign army’s are going around and shooting people.

Covid made plain that psyops work extremely well. A huge amount of disinformation came that way, in addition to a domestic audience that was very happy to incorporate it. Having a mistrust of authority in the first place makes this frictionless because it means you trust whatever you read online instead of your local authorities. That makes psyops easy peasy.

You can both not want foreign meddling and want to improve your local situation at the same time. Geopolitical issues are never a serial process, and they never end. There will never be a point where everyone agrees the domestic issues are now “fixed and everything is perfect” so now we can focus on the constant foreign attacks. That’s a false start.

Don’t throw the baby out with the bath water. When you burn it all down you’re just left with ashes, and whatever the replacement is almost always cheaper and worse.

You can safely assume that any big company in a G8 country is spilling data to the spook arm of the other 7.

Perhaps but it’s different when it’s an ally and intelligence gathering to face larger threats. That’s not the same thing as trying to bring down another society at large.

Why would you assume I was being national (implication: racial) about it. The national and cultural loyalties of the people working on these two products is highly similar.

I trust Instagram more because I was in the room when we said “using dwell as the signal and turning the online learning rate to who-the-fuck-cares is a bit much even for us”.

FB/Meta/IG’s bad, bad misses are just policy at ByteDance.

FB deliberately didn’t build this product because it’s kind of intense even as social media goes. Well ByteDance has decided that we’re all selling crack cocaine to 13-year-olds.

If anyone is going to display a modicum of social responsibility around this new lowest common denominator, it’s almost certainly FB.

It’s weird to find myself defending FB but in this instance it’s merited.

Nationalism is not racial. The implication is that you have more of a problem that China is seeing your data vs America just because it’s not your country, rather than both being equally bad (third party seeing and potentially using your data against your best interests or not compensating you for it).

Nationalism is the belief that your country is inherently better than others just because it is your country.

If everyone held this view then there would be no path that doesn’t lead away from national conflict, because all Chinese would choose China and all US people would choose US in these situations, rather than focusing on objective bad actors.

Are there even any good actors, when it comes to national governments?

Not saying that's an excuse for badness, but let's also not pretend that all governments are equally bad. I would rather the US violate my privacy than China, if those were my only choices.

Granted, currently I'm more or less physically out of reach of China's law enforcement, but well within the US's reach. So China having my data -- at least in the short term -- probably can't hurt me all that much. But longer term? Who knows.

"Equally bad" is objectively subjective. The reality is, especially on a long timeline, corrupt is corrupt and a degree of corruption is largely irrelevant. Instead we use the perceived degree of less corruption to justify nationalism and other things, and it's largely a matter of perspective. You probably wouldn't believe me but you ask the average Chinese person and they think the American government is just as corrupt as the Chinese. You may differ in your opinion. Who's right? Who knows? But I know one thing for sure, and it's that it doesn't matter who is less or more corrupt.

I’m on full take with both NSA and GHCQ minimum. I cut power to hardware when I want privacy. My ex-girlfriend is CIA, but uncle works for a defense contractor, and just for fun: I’m one of 10 or 20 colorful figures in tech who make a great story in the last ten years.

Have I seen shit? Yeah! Are you full of shit? Also yeah, unfortunately.

I don’t understand what you’re trying to tell me. Could you elaborate?

As does StackOverflow

You could argue that SO at least gives you some benefit - there are badges you can earn for popular shared links.

FB also claims their tracking is beneficial, they can show you more relevant ads this way.

Perhaps there are benefits to everything; is the cost, i.e. losing privacy, worth it?

True but the same can be achieved with just asking the person about their needs/interests or using only public data for ad targeting.

Second, this only applies to Facebook users, and yet they also track non-users despite them not even going to be showed any advertising.

It's not encoded though, your user ID is right there and you can strip it out. I agree that it could be clearer like /question/1234?utm_user=5678 instead of /question/1234/5678

Amazon does similar, along with a generally crap description of the product that isn't necessary, you only need the 'dp...' ID.

The end user viewer can also strip the sharing user ID easily if desired:

https://stackoverflow.com/q/10982911/149428

→

https://stackoverflow.com/q/10982911

→

https://stackoverflow.com/questions/10982911/creating-tempor...

Instagram does the same as well with your user ID as a query param when you share or copy a link.

Instagram === Facebook

So not much surprise here.

Tracking query string params in urls is nothing new, and its easy to spot.

What tiktok (and it looks Facebook is starting to do) is generate you a completely unique URL when sharing a video. Copy a tiktok video URL and you get something like tiktok-dot-com/video/abc456def - that ID at the end is unique to you. There's no tracking params to remove from the video because they encode the video ID and your user ID in the same 'field'

Well I didn't say this was "something new".

Your comment is somewhat accurate, but not the whole story.

A copied Tiktok share URL looks like this:

    https://www.tiktok.com/t/<unique_id>/?k=1

When pasted into a browser though, it redirects to the normal post URL:

    https://www.tiktok.com/@<author_username>/video/<video_id>?_t=<tracking_id>&_r=1

From there the tracking ID can be easily removed (by one's self) from the query params. This is in contrast to Facebook's new approach.

Reply on news.ycombinator.com