from Hacker News

TikTok requests access to devices on local network

by hacky_engineer on 8/16/21, 4:02 PM with 152 comments

  • by uniqueuid on 8/16/21, 5:00 PM

    Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1].

    [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2].

    [1] https://www.bleepingcomputer.com/news/security/ebay-port-sca...

    [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

  • by antioxidant on 8/16/21, 4:38 PM

    They used to check your clipboard the whole time too.

    They use the local network as one of their sensors to identify you (fingerprinting). However they have plenty more (see their privacy policy).

  • by diebeforei485 on 8/16/21, 4:39 PM

    Some other apps (Signal?) have also done this out of the blue, though they may have since added a UI around this.

    Regardless, Apple has done the right thing by putting this behind a permissions box, but the developer should be required to have some sort of explanation string of why they need this.

  • by the_mitsuhiko on 8/16/21, 7:04 PM

    For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actually your own network devices if you're connected on wifi. For instance sending a custom DNS query to the wifi advertised DNS server (if it's the router) will cause that dialog. Same thing happens if you happen to have a router redirect certain resources to itself. The latter typically at this point only happens for non encrypted HTTP traffic and that's basically no longer permitted.

    So why it happens exactly would be interesting.

  • by dangoor on 8/16/21, 4:23 PM

    Perhaps there's something nefarious here, or perhaps it's just looking for a Chromecast or Apple TV?

  • by uniqueuid on 8/16/21, 4:48 PM

    Microsoft Teams does this as well, purportedly for video calling (!?) Was there ever an explanation why the permissions are needed?

  • by q-rews on 8/16/21, 5:17 PM

    Is it TikTok or is it just because of a captive portal on the WiFi?

    It happened to me just yesterday: “Why does X require local network access? Ugh.” A minute later “Oh, Y is also requiring network access.”

    Yes, I was on a public wifi.

    This may be 100% Apple’s fault, everyone here is just commenting on a photo and not confirming that they also saw the message today.

  • by donohoe on 8/16/21, 6:42 PM

  • by hokkos on 8/16/21, 4:53 PM

    I'm pretty sure they use it for targeting, I remember tiktok presenting me video of interest shared by other under the same wifi.

  • by TchoBeer on 8/16/21, 8:26 PM

    This shouldn't be news, tons of apps do this; I suspect it's for something like Chromecasting, maybe it collects telemetry too?, either way not at all specific to TikTok.

  • by snapetom on 8/16/21, 7:40 PM

    Pokemon Go started asking for this back in March with an update. I don't think it was ever figured out why it would want access, and it's certainly not for Chromecast/Roku/AppleTV.

  • by j45 on 8/16/21, 8:59 PM

    Instagram is requesting access to local devices on the network as well as of yesterday.

  • by wyldfire on 8/16/21, 5:16 PM

    Many apps need to peer with a very short list of remote nodes. There are only some rare apps that need blanket network access to any other node. Maybe it's time for more permissions constraints to be applied?

  • by prashnts on 8/16/21, 6:17 PM

    Curiously, I have seen this prompt in apps that did not normally ask for this permission when I was on a captive network without having logged in. No idea why it was prompted, but could be related somehow?

  • by intrasight on 8/16/21, 4:44 PM

    So just use their web site. Honest question - why do people use apps for such?

  • by abledon on 8/16/21, 4:49 PM

    This is only the TikTok iOS/Android app right? Not the web app?

  • by Dragging-Syrup on 8/16/21, 4:32 PM

    Straight to the IOT isolation network

  • by jeffbee on 8/16/21, 4:51 PM

    There are two ways that the TikTok mobile app can be used to control the app running on a smart TV, android TV, roku, or whatever.

    1) The app on the smart tv can connect to a command-and-control network in the cloud, which will make deranged HNers howl in disapproval.

    2) The app on the phone can discover local devices it can control, which will make deranged HNers howl in disapproval.

  • by rvz on 8/16/21, 4:28 PM

    Why does TikTok 'need' access to devices on your local network?

    The intention from YouTube is obvious as they use it for Chromecast, but why does TikTok need this particular access? Have they disclosed this usage somewhere?

    On top of that and continuing from [0], it seems that it is collecting even more things that you may not even know about [0]. Far worse than the other apps out there.

    The purpose? The recommendation algorithm, of course. Otherwise, how else is it supposed to work?

    To Downvoters: Lots of commenters here saying that TikTok does not support AirPlay or Chromecast. Since that can be ruled out, what is the intention of this permission and is it disclosed anywhere on why do they need such access?

    I'm also assuming that you know why TikTok needs access to devices on your local network? Maybe you can elaborate on this?

    [0] https://news.ycombinator.com/item?id=28137000