Name: Why You Should Change This TikTok ‘Phone Tracking’ Setting
Brand: forbes.com
SKU: forbes-com-131
Availability: OnlineOnly

critic

Why You Should Change This TikTok ‘Phone Tracking’ Setting

preview

BETAThis is a BETA experience. You may opt-out by&nbsp;Jan 26, 2021,A new warning today for the hundreds of millions of users with TikTok’s app on their phones. If you have your phone number linked to your profile, you should remove it—but, beware, that’s very difficult to do. And while your number is still there, TikTok will use it to track you online. So, here’s what you do now.If you have TikTok on your phone, there’s a good chance it has your number—it’s the easiest way to sign up for an account and then login. But now security researchers at suggest you change that. “I see significant privacy risks in users giving TikTok their phone number as an account identifier,” Check Point’s Ekram Ahmed warns. “Phone numbers can be a very powerful data source for tracking location.”Check Point has issued this warning “given TikTok’s past issues with data security,” according to Ahmed. The security firm has just released a report into the latest such threat. The firm says that a server-side security vulnerability would have enabled an outside actor to query TikTok’s database, pulling private information, linking phone numbers to profiles. This could then have been used to harvest private contact details for celebrities or to build a database of users that could have been targeted at scale. Put simply, throwing lists of random numbers at TikTok returned matching profiles.Check Point’s Oded Vanunu tells me that the accessible details “included phone numbers, nicknames, profile and avatar pictures, unique user IDs, as well as certain profile settings, such as whether a user is a follower or if a user’s profile is hidden.”Linking phone numbers to social media profiles is not new—there’s another news story doing the rounds this week about a to do the same. But anything TikTok related carries extra spice given the U.S. campaign last year—this alleged links between the platform’s parent, ByteDance, and the Chinese state and that users risked their data being spirited back to China.MORE FROMResponding to the report, TikTok told me “the security, privacy, and safety of the TikTok community are our highest priorities. We appreciate the efforts of Check Point in identifying potential issues so that we can resolve them before users are impacted. We continue to invest in strengthening our automation defenses to minimize these types of attacks.”The security team at Check Point says it was prompted into finding this vulnerability by last year’s furor. Now, just as Trump unpacks his bags in Florida, its TikTok report has come out. Timing is everything. The specific issue relates to TikTok’s “find friends” feature, where a user’s contacts are matched It has now been fixed server-side. Users are advised to keep their apps updated, especially hyperscale apps which provide such a wide attack surface, but in this instance the fix doesn’t require a user update.The detailed technical POC behind&nbsp;&nbsp;has been shared in its report. In reality, the details here are less important than the broader issue—we share private data with social media apps and we expect that data to be safeguarded. But the clamor for new features that expand the viral reach of those apps or increase our hours spent on them introduces weaknesses that can be exploited. TikTok isn’t alone in this—. .“In general,” Vanunu says, “these vulnerabilities can exist on many digital platforms, but, with TikTok’s install base, the implications are high. In cyberspace the race for quality data is there, to be able to query TikTok’s database is great lead for bad actors, allowing them to bypass application protections and query the users ‘data lake’.”During Trump’s campaign against TikTok, the platform’s primary defense was that it was no different to (meaning no worse than) other social media platforms, Facebook in particular. But, rightly or wrongly, TikTok’s Chinese ownership has set the bar higher.That said, there is a serious irony here. Thanks to Apple’s privacy labels, we can compare TikTok and its two main competitors—Facebook’s Instagram and Snapchat. And there’s a twist. TikTok is broadly comparable to Snapchat, perhaps even a little better, given it doesn’t capture precise locations. But again it’s Facebook that provides a genuine shock at the sheer scale of its data machine—Instagram users beware.The real concern here is that is involves user phone numbers. You can use multiple email addresses, you can easily set up email aliases to protect you from leaks and phishing. But most of us have a single cell phone number—and that’s an immensely powerful data field. In the messaging world, there’s criticism that even the likes of Signal and Telegram optimize around a phone number—but with a messenger at least there’s some justification—it’s a communication tool, you use it to text and call.Despite all the recent furor about messaging apps—WhatsApp versus Signal and Telegram, Facebook Messenger’s poor privacy label when compared to the rest—none of those messaging apps use data to track users “across apps and websites used by other companies,” as defined by Apple. But TikTok and its competitors do exactly that.Media sharing apps like TikTok, Instagram and Snapchat use your number to link your profile to people you know—suggesting accounts to follow, enhancing their viral appeal. The easiest way to set up a new account on your phone is with your number—you’ll get an SMS code to verify that it’s yours. You’re then encouraged to allow the platform to use this data to match your contacts.As fun as all this sounds, you’re trusting those platforms with data that can do you harm. Cyberattacks using your phone number are much more dangerous than email equivalents, sending you malicious links or images or downloads. Those numbers also drive the scourge of messaging account hijacks we’re now seeing. If an attacker can match those numbers with other profile details, that is a powerful attack database.“It isn’t worth giving TikTok, Instagram or any social media platform your number to expedite finding your friends,” Ahmed says, “as you’ll likely trade short-term convenience for serious breaches of your privacy.”You’re safer using an email address and avoiding “find your friends” features, where the downside outweighs the benefits. On Instagram you can remove your number online or on the app and use an email address instead. You can still use SMS for two-factor authentication—in the past, Facebook did use 2FA phone numbers for advertising,&nbsp;.Removing your phone number on Snapchat is a little more difficult, but still only takes a couple of minutes. Make sure your main account has an email address so you can login, then set up a new account with your phone number as the identifier. Enter the text verification and the number will switch across. After checking your phone number has been removed from your real account, you can ignore the new one. There will likely be a red exclamation mark against the phone number field in your primary account—obviously do not revalidate your phone number here!But if you want to remove your phone number on TikTok you have a problem. Although adding a phone number when you set up your account is not mandatory, once you have done so the only way to remove it is by contacting support. As Ahmed points out, “the sheer difficulty a user must go through to remove their number from their account” is yet another reason not to give TikTok your number in the first place.&nbsp;“If a user would like to remove their phone number from their account,” a TikTok spokesperson told me, “they can contact support in app to help with that change. We continue to explore ways to make it easier for users to make these changes in app.”Indeed—one would certainly hope so.You can opt out of TikTok’s viral expansion, deselecting “suggest your account to others” under your privacy settings. But your number will remain on your profile, used to track you, linked to everything you do on your account. Despite the difficulties, you should seriously consider removing your number. Perhaps a few hundred thousand support requests will expedite that much needed update to enable this in the app itself.Meanwhile, any users of TikTok, Instagram or Snapchat, take a look at those privacy labels and give some thought as to the data you’re sharing. This is why all those apps on your phone appear to know everything about you, it’s why you’re constantly taken aback at the personalized nature of all those ads, it’s where those billions in ad revenue come from. Don’t forget—you’re not the customer, you’re the product.&nbsp;or&nbsp;.&nbsp;

BETAThis is a BETA experience. You may opt-out by&nbsp;Jan 26, 2021,A new warning today for the hundreds of millions of users with TikTok’s app on their phones. If you have your phone number linked to your profile, you should remove it—but, beware, that’s very difficult to do. And while your number is still there, TikTok will use it to track you online. So, here’s what you do now.If you have TikTok on your phone, there’s a good chance it has your number—it’s the easiest way to sign up for an account and then login. But now security researchers at suggest you change that. “I see significant...

public

Zak Doffman

Official account of Forbes, the world’s leading voice for entrepreneurial success and free enterprise, and home to breaking news, business, money and more.

Why You Should Change This TikTok ‘Phone Tracking’ Setting

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS