Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Very unlikely to be accurate. If it was, TikTok wouldn't be on the app stores.

* Browsing history: If a user uses a WebView in your app, you can obtain the history of* that WebView instance.

Xiaomi phones let applications have access to the first (100?) bytes of each pcap line. [note: this is probably unintended, but their bug bounty programme didn't care].

* Keystroke patterns: You can track user keystrokes within your app. If you're a keyboard or accessibility provider, you can access keystrokes globally. I haven't used TikTok, but it's very unlikely that they do either of these, the UX to enable them is not pleasant because they're dangerous actions to take.

* Biometric identifiers: If a user takes a selfie, you have their iris/fingerprint/faceprint



>Xiaomi phones let applications have access to the first (100?) bytes of each pcap line

What is pcap line?


A 'row' of packet capture data (in Wireshark's output). I apologize for the lack of clarity. I'm unfamiliar with network terminology and unsure what this looks like on the binary level.

The files are in: /storage/emulated/0/MIUI/debug_log/common/tcpdump if you have a phone to test.


Does it refer to just WebView in your own app or general browser app too?


The standard Android ability to get WebView history is only the history for the instance of the WebView which you created (totally reasonable IMO, there's lots of non-nefarious purposes that you'd want to intercept requests[0]).

To my limited understanding, the file on Xiaomi phones is a dump of all the packets that your router would see. If you're using HTTPS, it's probably leaking the sites, but it's mostly garbage.

[0] https://github.com/ankidroid/Anki-Android/blob/31cfbc914a746...




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: