The browser within the TikTok app can track your every move on the website you have opened.
You know how some popular apps don't let you exit the app when you click on a link, opening said link in their own little in-app browser?
As it turns out, this allows these apps to track what you do. And among the most popular apps that do this, TikTok seems to be the worst offender.
In a blog post on Thursday, security researcher Felix Krause announced the release of InAppBrowser, a tool that lists all JavaScript commands executed by an app iOS while the in-app browser renders a web page.
See also: TikTok may be working on a music streaming service
To show what the tool can do, Krause analyzed a number of popular iOS apps that have an in-app browser, and the results are alarming. Krause’s data shows that apps including TikTok, Instagram, Facebook Messenger, and Facebook modify all web pages that open in the in-app browser. “This includes adding tracking code (such as inputs, text selections, clicks, etc.), inserting external JavaScript files, and creating new HTML elements,” Krause says. They also grab metadata , though Krause says this is “harmless.”
When Krause dug a little deeper into what these apps ’ browsers actually do , he found that TikTok does some nasty things , including tracking all of a user’s input and keystrokes . So, if you open a webpage inside the TikTok app and enter your credit card information there, TikTok can access all of that information. TikTok is also the only app, out of all the apps Krause examined, that doesn’t even offer the option to open the link in the device’s default browser , forcing you to go through its own in-app browser.
In a statement to Forbes, a TikTok spokesperson confirmed the practice, but says that “the Javascript code in question is only used for debugging, troubleshooting, and monitoring experience performance.”
See also: Kylie Jenner and Kim Kardashian on Instagram: Don't copy TikTok!
All of this is needed to provide “an optimal user experience,” he said.
Other apps Krause examined, like Instagram, also do some of their own tracking, though none of them go as far as TikTok. Both Snapchat and Robinhood are good examples, as they don't modify websites or retrieve metadata for the sites you open in their browsers.
Krause warns that apps actually have a way to hide their JavaScript activity from the InAppBrowser tool, which means they could be doing more tracking behind the scenes. For now, the only way to make sure they can't do any tracking is to open websites in the device's default browser — if the app even offers that option.
Source: mashable.com
