10 ms·

TikTok requests access to devices on local network

323 points by hacky_engineer 5y ago

snapetom 5y ago
Pokemon Go started asking for this back in March with an update. I don't think it was ever figured out why it would want access, and it's certainly not for Chromecast/Roku/AppleTV.
- SllX 5y ago
  Pokéball Plus support. I mean, I can’t speak to Niantic fingerprinting players because I don’t know if they are, but you do need Bluetooth to use the Pokéball Plus properly. Also I believe you need Bluetooth to work with the Let’s Go Pikachu and Eevee games on the Switch to transfer Pokémon back and forth, but I never did get that to work properly.
  - snapetom 5y ago
    Yeah, but Let's Go and Pokeball were released years ago. Go Plus was released almost Day 1, if I recall. All of those connect via Bluetooth and never required a network. They all still work just fine if you deny PoGo the permission to access devices.
    - SllX 5y ago
      Correct me if I’m wrong, but isn’t this the same dialog that pops up for Bluetooth devices or am I missing something? I haven’t used my Pokeball Plus since about a month after I bought it, which was basically day or week 1, but if I recall correctly the mandate to ask for permissions only came around after that time frame and I would expect it the next time I pulled it out. But if it does work without Bluetooth permissions; then that’s cool, or if this is a separate dialog than the Bluetooth permissions dialog, then I’m just wrong which is also fine and I can live with that.
      - snapetom 5y ago
        No, it's definitely different. The Bluetooth permissions come up whenever you pair a new Pokeball/Go Plus/3rd Party Device like Gotcha. It strictly asks if you want to pair a new Bluetooth device. The network discovery is different. iOS will popup a dialog saying something like, "Pokemon Go wants to discover other devices on your network" or something like that, which is what this story is about. I believe it pops up once when you install and sign up, but then it never asks again.
        SllX 5y ago
        I see. In that case I stand corrected. Thanks!
dangoor 5y ago
Perhaps there's something nefarious here, or perhaps it's just looking for a Chromecast or Apple TV?
- xfitm3 5y ago
  Assuming this is iOS doesn't the native screen sharing capability handle that?
  - mholm 5y ago
    Not chromecast. My charitable guess is they're adding support for chromecasting behind feature flags/AB testing, but don't yet have it correctly enabled/disabled. There was a lot of uproar over instagram immediately using the microphone/camera constantly, when they actually just always had the API initialized to make swiping to the camera snappier.
    - danudey 5y ago
      That could also explain why they didn't bother to provide in the notification to the user why they're requesting this access: because they weren't intending to request it (yet). I find the conspiracy theories more compelling, but less likely.
      - toxik 5y ago
        When an app tells you it’s stealing your data, I would say you should believe it.
- mercora 5y ago
  it would be a little too obvious if this is done for nefarious reasons by TikTok developers themselves.
  - mtgx 5y ago
    Why too obvious? 99% of people don't pay attention to this stuff. Look at what Facebook has been doing to users for years and years before being caught and blaming it on a bug or becoming way to familiar to Britney's lyrics in "Oops, I did it again."
rvz 5y ago
Why does TikTok 'need' access to devices on your local network? The intention from YouTube is obvious as they use it for Chromecast, but why does TikTok need this particular access? Have they disclosed this usage somewhere? On top of that and continuing from [0], it seems that it is collecting even more things that you may not even know about [0]. Far worse than the other apps out there. The purpose? The recommendation algorithm, of course. Otherwise, how else is it supposed to work? To Downvoters: Lots of commenters here saying that TikTok does not support AirPlay or Chromecast. Since that can be ruled out, what is the intention of this permission and is it disclosed anywhere on why do they need such access? I'm also assuming that you know why TikTok needs access to devices on your local network? Maybe you can elaborate on this? [0] https://news.ycombinator.com/item?id=28137000 https://news.ycombinator.com/item?id=28137000
Dragging-Syrup 5y ago
Straight to the IOT isolation network
- moooo99 5y ago
  Your phone?
  - MisterTea 5y ago
    I mean if its being hostile to your LAN then why not? Let the hostile phones, TV's, sonos, toasters, etc live on the IOT network and your laptop, desktop, NAS and whatever else you value live on a your actual LAN.
antioxidant 5y ago
They used to check your clipboard the whole time too. They use the local network as one of their sensors to identify you (fingerprinting). However they have plenty more (see their privacy policy).
- judge2020 5y ago
  > They used to check your clipboard the whole time too. To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.
  - MichaelGroves 5y ago
    "Lots of people do it" should never be considered a legitimate excuse. Trying to use that excuse should get you kicked out of the meeting room.
    - hungryhobo 5y ago
      why should it get you kicked out of the meeting room? if everyone else is doing it and have a better ux, i'd imagine you'd be kicked out of the meeting roomm if you're not doing it.
    - dudus 5y ago
      Everything TikTok is usually linked to malice and espionage from China. If this is a common industry practice at the very least you give it the benefit of the doubt. It doesn't make it ok. It just makes it not automatically linked to international cyber warfare.
      - smolder 5y ago
        The incidents that might qualify as cyber warfare could also just be looked at as the same struggle for power on a different front, compared to economics. It can't be lost on Chinese leaders how valuable it is to the US to have so much money and data flowing through its domestic tech companies. Tech companies can't cross the line into cyber warfare themselves and get a pass on it, but they do play a role in it.
diebeforei485 5y ago
Some other apps (Signal?) have also done this out of the blue, though they may have since added a UI around this. Regardless, Apple has done the right thing by putting this behind a permissions box, but the developer should be required to have some sort of explanation string of why they need this.
- alerighi 5y ago
  That thing makes it annoying for the kind of applications my company does, that needs to communicate with other devices on the local network. It's annoying because it's not like other permissions, where you can ask the OS to prompt the user, and check if the user granted it or not, but it's some special permission. If the user, by mistake because it doesn't know that it's needed, doesn't give it one time it's impossible to ask again, and the app doesn't have a way to know that the permission is not granted. It's just things that the customer service has to handle, and that is bad. Sure, right to ask a permission, so make it like a regular permission as the location permission.
  - swiley 5y ago
    If you're truly not being malicious then open source your app and get it added to the alpine repos so people can run it in ish.
  - t0ps0il 5y ago
    > It's annoying because it's not like other permissions Normally if I want to use a permission, say location, I need to provide a value for given permission in my app's `info.plist` file, and if I don't and the app tries to grab the current location, it crashes with logs yelling at me to provide a description for the location privacy key. With local network permissions it's different. I've never had to do any local networking in my career as an iOS dev so downloaded Apple's peer to peer example app (https://developer.apple.com/documentation/network/building_a_custom_peer-to-peer_protocol https://developer.apple.com/documentation/network/building_a...) and removed the `Privacy - Local Network Usage Description` key/value pair from the `info.plist` file and ran the app on my device. I fully expected a crash with a description telling me to add this key but iOS just filled in the missing description with a default value and asked away. I wonder why that permission is treated differently from the rest?
intrasight 5y ago
So just use their web site. Honest question - why do people use apps for such?
- micromacrofoot 5y ago
  On mobile they heavily push people to the app... this is the answer to most "just use the website" questions. Reddit mobile has been particularly bad about this lately, by blocking content. Instagram hits you with a login gate after viewing a few photos, etc... all of these companies are pushing their users to the place where they can siphon off the most data, which at the moment are apps.
- cblconfederate 5y ago
  You mean you don't like being spied on?
- finiteseries 5y ago
  Because that’s how <insert app> is used. The concept of apps and web sites being separate things, or being different, or preferable to one another isn’t on the radar of 95% of people, it’s a blurry shapeless vagueness the mind glazes over if it’s ever forced into recognizing its existence, and immediately discarded afterwards. You’re asking a forum of power users/creators, where a loud minority completely unironically still use desktop & laptop computers for activities besides work. The only people on earth less understanding (intentionally or not) of consumer behavior are the Sentinelese.
  - JadeNB 5y ago
    > a loud minority completely unironically still use desktop & laptop computers for activities besides work. Is using a desktop or laptop for non-work activities ironic somehow?
    - finiteseries 5y ago
      I honestly don’t know what exactly irony means. unironically = sincerely/earnestly
uniqueuid 5y ago
Microsoft Teams does this as well, purportedly for video calling (!?) Was there ever an explanation why the permissions are needed?
- lloydatkinson 5y ago
  For MS I suspect either incompetence or laziness and just checking all the permissions (because a lot of Teams seems poorly thought out and designed by committee, probably an “agile” one too). As for Tick Tock it’s obviously spyware meant for direct user identification. How anyone can use it when it’s uploading their biometric information (face, voice) to the CCP is beyond stupidity.
  - andrewmd5 5y ago
    It is to support finding devices you can cast to inside the app (like conference calling boxes.)
  - po1nter 5y ago
    It's TikTok* and do you have any evidence to support what you're saying or you're just pulling this from thin air?
    - filoleg 5y ago
      So far from what I’ve seen, it is mostly along the lines of “they technically can, so I assume they do.” Even when it comes to someone like me, who is very strongly anti-CCP, it definitely irks me a bit. Mostly because making strong accusations like that without any reasoning other than “they can, so they definitely do it” only makes that position look weaker and more difficult to align with. Why make up those things and accusations, when there are so many other valid points for criticism there? There is a reason for why “the boy who cried wolf” is a very commonly referenced parable.
    - lloydatkinson 5y ago
      Tick Tock, thanks.
abledon 5y ago
This is only the TikTok iOS/Android app right? Not the web app?
- throw03172019 5y ago
  Yes, iOS app in this specific case.
jeffbee 5y ago
There are two ways that the TikTok mobile app can be used to control the app running on a smart TV, android TV, roku, or whatever. 1) The app on the smart tv can connect to a command-and-control network in the cloud, which will make deranged HNers howl in disapproval. 2) The app on the phone can discover local devices it can control, which will make deranged HNers howl in disapproval.
hokkos 5y ago
I'm pretty sure they use it for targeting, I remember tiktok presenting me video of interest shared by other under the same wifi.
- SubiculumCode 5y ago
  Very curios coincidence. I watched a little TikTok this morning and found my daughter's account in my feed.
uniqueuid 5y ago
Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1]. [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2]. [1] https://www.bleepingcomputer.com/news/security/ebay-port-scans-visitors-computers-for-remote-access-programs/ https://www.bleepingcomputer.com/news/security/ebay-port-sca... [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...
- hipsterhelpdesk 5y ago
  It only “leaks” your ip if you are trying to use webrtc features with a vpn, otherwise web rtc is perfectly fine to use without concern for most people.
  - uniqueuid 5y ago
    Interesting! That's not how I read the ublock origin docs: "Keep in mind that this feature is to prevent leakage of your non-internet-facing IP adresses. The purpose of this feature is not to hide your current internet-facing IP address -- so be cautious to not misinterpret the results of some WebRTC-local-IP-address-leakage tests found online." That said, my Firefox 91 and Safari don't leak local IPs regardless of the ublock setting. Warrants more investigation perhaps.
    - allo37 5y ago
      I believe newer versions of WebRTC use mdns to mask local IPs: https://bugs.chromium.org/p/chromium/issues/detail?id=878465 https://bugs.chromium.org/p/chromium/issues/detail?id=878465
      - uniqueuid 5y ago
        Great find! Here's the IETF draft [1], submitted by Apple (which would explain why I'm not seeing leaks on Safari) [1] https://datatracker.ietf.org/doc/html/draft-mdns-ice-candidates-00 https://datatracker.ietf.org/doc/html/draft-mdns-ice-candida...
micromacrofoot 5y ago
Don't forget that TikTok is also currently under investigation by the US secretary of commerce to determine whether or not it's a threat to national security. Are people getting enough out of the content on TikTok to warrant installing an app from a country that has been outright hostile to the US (from a cybersecurity perspective)? I've seen some of the most popular TikTok content without ever creating an account.
wyldfire 5y ago
Many apps need to peer with a very short list of remote nodes. There are only some rare apps that need blanket network access to any other node. Maybe it's time for more permissions constraints to be applied?
q-rews 5y ago
Is it TikTok or is it just because of a captive portal on the WiFi? It happened to me just yesterday: “Why does X require local network access? Ugh.” A minute later “Oh, Y is also requiring network access.” Yes, I was on a public wifi. This may be 100% Apple’s fault, everyone here is just commenting on a photo and not confirming that they also saw the message today.
- Too 5y ago
  I had same thing happen some days ago while rebooting my modem at home after accidentally unplugging it. All kinds of apps I use regularly, which have absolutely no use for it, started asking for permission to list devices on local network.
prashnts 5y ago
Curiously, I have seen this prompt in apps that did not normally ask for this permission when I was on a captive network without having logged in. No idea why it was prompted, but could be related somehow?
donohoe 5y ago
Twitter does it too https://twitter.com/donohoe/status/1412563187426369537 https://twitter.com/donohoe/status/1412563187426369537
the_mitsuhiko 5y ago
For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actually your own network devices if you're connected on wifi. For instance sending a custom DNS query to the wifi advertised DNS server (if it's the router) will cause that dialog. Same thing happens if you happen to have a router redirect certain resources to itself. The latter typically at this point only happens for non encrypted HTTP traffic and that's basically no longer permitted. So why it happens exactly would be interesting.
- uniqueuid 5y ago
  Thanks for the details! That opens new questions; for example, what's a "custom" DNS query? One that doesn't use mDNSResponder (or whatever iOS uses right now)?
  - the_mitsuhiko 5y ago
    I am not sure under which circumstances it flags. If you write your own DNS client for sure it will happen, but there seem to be more things that cause this to trigger. After that dialog was introduced I saw it pop up on stack overflow for some relatively common libraries (for instance with unity) even if they did not attempt to access the local network.
- stingraycharles 5y ago
  Interesting. I initially denied the permission, but Tiktok seemed to not be able to make any Internet requests. The kind of behavior I would expect if DNS didn’t work anymore. Maybe it’s just as innocent as this, but OTOH, it’s tiktok we’re talking about.
- nicce 5y ago
  More context, especially resolving link-local DNS names (those ending with local, per RFC 6762) requires local network access. For iOS devices, Apple has summed this pretty well[1]. Yes, if permission required on below: Making an outgoing TCP connection — yes Listening for and accepting incoming TCP connections — no Sending a UDP unicast — yes Sending a UDP multicast — yes Sending a UDP broadcast — yes Receiving an incoming UDP unicast — no Receiving an incoming UDP multicast — yes Receiving an incoming UDP broadcast — yes And finally usage of Bonjour operations. [1] https://developer.apple.com/forums/thread/663874 https://developer.apple.com/forums/thread/663874
TchoBeer 5y ago
This shouldn't be news, tons of apps do this; I suspect it's for something like Chromecasting, maybe it collects telemetry too?, either way not at all specific to TikTok.
- qwerty456127 5y ago
  > Chromecasting IMHO the OS or some common proxy app should take care of this. Yes, Chromecasting is a legitimate case and it's nice of TikTok or any other relevant app to offer such a feature but I don't trust random (let alone Chinese) app vendors to scan my home network.
j45 5y ago
Instagram is requesting access to local devices on the network as well as of yesterday.
_user112 5y ago
Uses a TikTok, concerned about network discovery. So many mentally ill people. Please meditate, and engage in introspection. TikTok literally, openly says it's an artificial neutral net that games the human brain for attention.

Pokemon Go started asking for this back in March with an update. I don't think it was ever figured out why it would want access, and it's certainly not for Chromecast/Roku/AppleTV.

SllX 5y ago
Pokéball Plus support. I mean, I can’t speak to Niantic fingerprinting players because I don’t know if they are, but you do need Bluetooth to use the Pokéball Plus properly. Also I believe you need Bluetooth to work with the Let’s Go Pikachu and Eevee games on the Switch to transfer Pokémon back and forth, but I never did get that to work properly.
- snapetom 5y ago
  Yeah, but Let's Go and Pokeball were released years ago. Go Plus was released almost Day 1, if I recall. All of those connect via Bluetooth and never required a network. They all still work just fine if you deny PoGo the permission to access devices.
  - SllX 5y ago
    Correct me if I’m wrong, but isn’t this the same dialog that pops up for Bluetooth devices or am I missing something? I haven’t used my Pokeball Plus since about a month after I bought it, which was basically day or week 1, but if I recall correctly the mandate to ask for permissions only came around after that time frame and I would expect it the next time I pulled it out. But if it does work without Bluetooth permissions; then that’s cool, or if this is a separate dialog than the Bluetooth permissions dialog, then I’m just wrong which is also fine and I can live with that.
    - snapetom 5y ago
      No, it's definitely different. The Bluetooth permissions come up whenever you pair a new Pokeball/Go Plus/3rd Party Device like Gotcha. It strictly asks if you want to pair a new Bluetooth device. The network discovery is different. iOS will popup a dialog saying something like, "Pokemon Go wants to discover other devices on your network" or something like that, which is what this story is about. I believe it pops up once when you install and sign up, but then it never asks again.
      - SllX 5y ago
        I see. In that case I stand corrected. Thanks!

dangoor 5y ago

Perhaps there's something nefarious here, or perhaps it's just looking for a Chromecast or Apple TV?

xfitm3 5y ago
Assuming this is iOS doesn't the native screen sharing capability handle that?
- mholm 5y ago
  Not chromecast. My charitable guess is they're adding support for chromecasting behind feature flags/AB testing, but don't yet have it correctly enabled/disabled. There was a lot of uproar over instagram immediately using the microphone/camera constantly, when they actually just always had the API initialized to make swiping to the camera snappier.
  - danudey 5y ago
    That could also explain why they didn't bother to provide in the notification to the user why they're requesting this access: because they weren't intending to request it (yet). I find the conspiracy theories more compelling, but less likely.
    - toxik 5y ago
      When an app tells you it’s stealing your data, I would say you should believe it.
mercora 5y ago
it would be a little too obvious if this is done for nefarious reasons by TikTok developers themselves.
- mtgx 5y ago
  Why too obvious? 99% of people don't pay attention to this stuff. Look at what Facebook has been doing to users for years and years before being caught and blaming it on a bug or becoming way to familiar to Britney's lyrics in "Oops, I did it again."

rvz 5y ago

Why does TikTok 'need' access to devices on your local network? The intention from YouTube is obvious as they use it for Chromecast, but why does TikTok need this particular access? Have they disclosed this usage somewhere? On top of that and continuing from [0], it seems that it is collecting even more things that you may not even know about [0]. Far worse than the other apps out there. The purpose? The recommendation algorithm, of course. Otherwise, how else is it supposed to work? To Downvoters: Lots of commenters here saying that TikTok does not support AirPlay or Chromecast. Since that can be ruled out, what is the intention of this permission and is it disclosed anywhere on why do they need such access? I'm also assuming that you know why TikTok needs access to devices on your local network? Maybe you can elaborate on this? [0] https://news.ycombinator.com/item?id=28137000 https://news.ycombinator.com/item?id=28137000

Dragging-Syrup 5y ago

Straight to the IOT isolation network

moooo99 5y ago
Your phone?
- MisterTea 5y ago
  I mean if its being hostile to your LAN then why not? Let the hostile phones, TV's, sonos, toasters, etc live on the IOT network and your laptop, desktop, NAS and whatever else you value live on a your actual LAN.

antioxidant 5y ago

They used to check your clipboard the whole time too. They use the local network as one of their sensors to identify you (fingerprinting). However they have plenty more (see their privacy policy).

judge2020 5y ago
> They used to check your clipboard the whole time too. To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.
- MichaelGroves 5y ago
  "Lots of people do it" should never be considered a legitimate excuse. Trying to use that excuse should get you kicked out of the meeting room.
  - hungryhobo 5y ago
    why should it get you kicked out of the meeting room? if everyone else is doing it and have a better ux, i'd imagine you'd be kicked out of the meeting roomm if you're not doing it.
  - dudus 5y ago
    Everything TikTok is usually linked to malice and espionage from China. If this is a common industry practice at the very least you give it the benefit of the doubt. It doesn't make it ok. It just makes it not automatically linked to international cyber warfare.
    - smolder 5y ago
      The incidents that might qualify as cyber warfare could also just be looked at as the same struggle for power on a different front, compared to economics. It can't be lost on Chinese leaders how valuable it is to the US to have so much money and data flowing through its domestic tech companies. Tech companies can't cross the line into cyber warfare themselves and get a pass on it, but they do play a role in it.

diebeforei485 5y ago

Some other apps (Signal?) have also done this out of the blue, though they may have since added a UI around this. Regardless, Apple has done the right thing by putting this behind a permissions box, but the developer should be required to have some sort of explanation string of why they need this.

alerighi 5y ago
That thing makes it annoying for the kind of applications my company does, that needs to communicate with other devices on the local network. It's annoying because it's not like other permissions, where you can ask the OS to prompt the user, and check if the user granted it or not, but it's some special permission. If the user, by mistake because it doesn't know that it's needed, doesn't give it one time it's impossible to ask again, and the app doesn't have a way to know that the permission is not granted. It's just things that the customer service has to handle, and that is bad. Sure, right to ask a permission, so make it like a regular permission as the location permission.
- swiley 5y ago
  If you're truly not being malicious then open source your app and get it added to the alpine repos so people can run it in ish.
- t0ps0il 5y ago
  > It's annoying because it's not like other permissions Normally if I want to use a permission, say location, I need to provide a value for given permission in my app's `info.plist` file, and if I don't and the app tries to grab the current location, it crashes with logs yelling at me to provide a description for the location privacy key. With local network permissions it's different. I've never had to do any local networking in my career as an iOS dev so downloaded Apple's peer to peer example app (https://developer.apple.com/documentation/network/building_a_custom_peer-to-peer_protocol https://developer.apple.com/documentation/network/building_a...) and removed the `Privacy - Local Network Usage Description` key/value pair from the `info.plist` file and ran the app on my device. I fully expected a crash with a description telling me to add this key but iOS just filled in the missing description with a default value and asked away. I wonder why that permission is treated differently from the rest?

intrasight 5y ago

So just use their web site. Honest question - why do people use apps for such?

micromacrofoot 5y ago
On mobile they heavily push people to the app... this is the answer to most "just use the website" questions. Reddit mobile has been particularly bad about this lately, by blocking content. Instagram hits you with a login gate after viewing a few photos, etc... all of these companies are pushing their users to the place where they can siphon off the most data, which at the moment are apps.
cblconfederate 5y ago
You mean you don't like being spied on?
finiteseries 5y ago
Because that’s how <insert app> is used. The concept of apps and web sites being separate things, or being different, or preferable to one another isn’t on the radar of 95% of people, it’s a blurry shapeless vagueness the mind glazes over if it’s ever forced into recognizing its existence, and immediately discarded afterwards. You’re asking a forum of power users/creators, where a loud minority completely unironically still use desktop & laptop computers for activities besides work. The only people on earth less understanding (intentionally or not) of consumer behavior are the Sentinelese.
- JadeNB 5y ago
  > a loud minority completely unironically still use desktop & laptop computers for activities besides work. Is using a desktop or laptop for non-work activities ironic somehow?
  - finiteseries 5y ago
    I honestly don’t know what exactly irony means. unironically = sincerely/earnestly

uniqueuid 5y ago

Microsoft Teams does this as well, purportedly for video calling (!?) Was there ever an explanation why the permissions are needed?

lloydatkinson 5y ago
For MS I suspect either incompetence or laziness and just checking all the permissions (because a lot of Teams seems poorly thought out and designed by committee, probably an “agile” one too). As for Tick Tock it’s obviously spyware meant for direct user identification. How anyone can use it when it’s uploading their biometric information (face, voice) to the CCP is beyond stupidity.
- andrewmd5 5y ago
  It is to support finding devices you can cast to inside the app (like conference calling boxes.)
- po1nter 5y ago
  It's TikTok* and do you have any evidence to support what you're saying or you're just pulling this from thin air?
  - filoleg 5y ago
    So far from what I’ve seen, it is mostly along the lines of “they technically can, so I assume they do.” Even when it comes to someone like me, who is very strongly anti-CCP, it definitely irks me a bit. Mostly because making strong accusations like that without any reasoning other than “they can, so they definitely do it” only makes that position look weaker and more difficult to align with. Why make up those things and accusations, when there are so many other valid points for criticism there? There is a reason for why “the boy who cried wolf” is a very commonly referenced parable.
  - lloydatkinson 5y ago
    Tick Tock, thanks.

abledon 5y ago

This is only the TikTok iOS/Android app right? Not the web app?

throw03172019 5y ago
Yes, iOS app in this specific case.

jeffbee 5y ago

There are two ways that the TikTok mobile app can be used to control the app running on a smart TV, android TV, roku, or whatever. 1) The app on the smart tv can connect to a command-and-control network in the cloud, which will make deranged HNers howl in disapproval. 2) The app on the phone can discover local devices it can control, which will make deranged HNers howl in disapproval.

hokkos 5y ago

I'm pretty sure they use it for targeting, I remember tiktok presenting me video of interest shared by other under the same wifi.

SubiculumCode 5y ago
Very curios coincidence. I watched a little TikTok this morning and found my daughter's account in my feed.

uniqueuid 5y ago

Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1]. [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2]. [1] https://www.bleepingcomputer.com/news/security/ebay-port-scans-visitors-computers-for-remote-access-programs/ https://www.bleepingcomputer.com/news/security/ebay-port-sca... [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

hipsterhelpdesk 5y ago
It only “leaks” your ip if you are trying to use webrtc features with a vpn, otherwise web rtc is perfectly fine to use without concern for most people.
- uniqueuid 5y ago
  Interesting! That's not how I read the ublock origin docs: "Keep in mind that this feature is to prevent leakage of your non-internet-facing IP adresses. The purpose of this feature is not to hide your current internet-facing IP address -- so be cautious to not misinterpret the results of some WebRTC-local-IP-address-leakage tests found online." That said, my Firefox 91 and Safari don't leak local IPs regardless of the ublock setting. Warrants more investigation perhaps.
  - allo37 5y ago
    I believe newer versions of WebRTC use mdns to mask local IPs: https://bugs.chromium.org/p/chromium/issues/detail?id=878465 https://bugs.chromium.org/p/chromium/issues/detail?id=878465
    - uniqueuid 5y ago
      Great find! Here's the IETF draft [1], submitted by Apple (which would explain why I'm not seeing leaks on Safari) [1] https://datatracker.ietf.org/doc/html/draft-mdns-ice-candidates-00 https://datatracker.ietf.org/doc/html/draft-mdns-ice-candida...

micromacrofoot 5y ago

Don't forget that TikTok is also currently under investigation by the US secretary of commerce to determine whether or not it's a threat to national security. Are people getting enough out of the content on TikTok to warrant installing an app from a country that has been outright hostile to the US (from a cybersecurity perspective)? I've seen some of the most popular TikTok content without ever creating an account.

wyldfire 5y ago

Many apps need to peer with a very short list of remote nodes. There are only some rare apps that need blanket network access to any other node. Maybe it's time for more permissions constraints to be applied?

q-rews 5y ago

Is it TikTok or is it just because of a captive portal on the WiFi? It happened to me just yesterday: “Why does X require local network access? Ugh.” A minute later “Oh, Y is also requiring network access.” Yes, I was on a public wifi. This may be 100% Apple’s fault, everyone here is just commenting on a photo and not confirming that they also saw the message today.

Too 5y ago
I had same thing happen some days ago while rebooting my modem at home after accidentally unplugging it. All kinds of apps I use regularly, which have absolutely no use for it, started asking for permission to list devices on local network.

prashnts 5y ago

Curiously, I have seen this prompt in apps that did not normally ask for this permission when I was on a captive network without having logged in. No idea why it was prompted, but could be related somehow?

donohoe 5y ago

Twitter does it too https://twitter.com/donohoe/status/1412563187426369537 https://twitter.com/donohoe/status/1412563187426369537

the_mitsuhiko 5y ago

For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actually your own network devices if you're connected on wifi. For instance sending a custom DNS query to the wifi advertised DNS server (if it's the router) will cause that dialog. Same thing happens if you happen to have a router redirect certain resources to itself. The latter typically at this point only happens for non encrypted HTTP traffic and that's basically no longer permitted. So why it happens exactly would be interesting.

uniqueuid 5y ago
Thanks for the details! That opens new questions; for example, what's a "custom" DNS query? One that doesn't use mDNSResponder (or whatever iOS uses right now)?
- the_mitsuhiko 5y ago
  I am not sure under which circumstances it flags. If you write your own DNS client for sure it will happen, but there seem to be more things that cause this to trigger. After that dialog was introduced I saw it pop up on stack overflow for some relatively common libraries (for instance with unity) even if they did not attempt to access the local network.
stingraycharles 5y ago
Interesting. I initially denied the permission, but Tiktok seemed to not be able to make any Internet requests. The kind of behavior I would expect if DNS didn’t work anymore. Maybe it’s just as innocent as this, but OTOH, it’s tiktok we’re talking about.
nicce 5y ago
More context, especially resolving link-local DNS names (those ending with local, per RFC 6762) requires local network access. For iOS devices, Apple has summed this pretty well[1]. Yes, if permission required on below: Making an outgoing TCP connection — yes Listening for and accepting incoming TCP connections — no Sending a UDP unicast — yes Sending a UDP multicast — yes Sending a UDP broadcast — yes Receiving an incoming UDP unicast — no Receiving an incoming UDP multicast — yes Receiving an incoming UDP broadcast — yes And finally usage of Bonjour operations. [1] https://developer.apple.com/forums/thread/663874 https://developer.apple.com/forums/thread/663874

TchoBeer 5y ago

This shouldn't be news, tons of apps do this; I suspect it's for something like Chromecasting, maybe it collects telemetry too?, either way not at all specific to TikTok.

qwerty456127 5y ago
> Chromecasting IMHO the OS or some common proxy app should take care of this. Yes, Chromecasting is a legitimate case and it's nice of TikTok or any other relevant app to offer such a feature but I don't trust random (let alone Chinese) app vendors to scan my home network.

j45 5y ago

Instagram is requesting access to local devices on the network as well as of yesterday.

_user112 5y ago

Uses a TikTok, concerned about network discovery. So many mentally ill people. Please meditate, and engage in introspection. TikTok literally, openly says it's an artificial neutral net that games the human brain for attention.