Esther a.k.a U039b🧵With the growing concerns about #TikTok, I finally decided to have a look to it. In this thread, I will cover a review of its privacy policy and a quick dynamic analysis of the Android app with @pts and explain its limitations.
First of all, TikTok's privacy policy is quite explicit regarding what data is collected. Obviously, it collects the information the user provides such as profile information, contacts, payment card information or other third-party payment information.
Next, TikTok automatically collects a wide range of information such as keystroke patterns or rhythms, IP address, approximate location based on SIM card, IP address or location service. The app automatically detects and collects characteristics and features about the videos, images, and audio recordings by identifying objects and scenery.
The platform also infers information such as gender or interests and certainly more based on what we watch, what we like, the location where the app is used, etc. The purpose here is to build a profile in order to “suggest" relevant content.
Next, #TikTok gathers information from partners without explicitly telling who they are. It gets from partners information such as mobile identifiers, email address (plain or hashed), user ID and actions taken outside of the Platform.
#TikTok not only gathers information from partners, it shares some too without listing them. The platform shares unlisted information with advertisers to provide targeted ads and share technical and usage information with data partners, analytics services.
The business model of #TikTok, #Facebook and others is based on the attention economy. The longer you stay, the more ads you see, the more money we make. This MB relies on targeted ads, thus, the platform has to collect a pile of info to build a profile as accurate as possible.
Robert Riemann 🇪🇺@U039b that's a screenshot of MitMProxy?
@rriemann No, it is a screenshot of a tool named Colander I am developing part of https://pts-project.org/. I don't use mitm-proxy anymore since it implies lots of drawbacks when used in the context of legal cases.
More details: https://pts-project.org/blog/year-2022-in-review/#colander
Open-Source Platform for Mobile Device Forensics and Digital Investigations
PiRogue Tool Suite (PTS) is a comprehensive, open-source digital investigation platform designed to empower organizations in an increasingly complex digital landscape. We provide accessible and powerful tools for network analysis, mobile forensics, and collaborative case management, specifically tailored for civil society, digital rights defenders, researchers, journalists, and regulatory bodies.