TIL that if you try to sign up for Tiktok by signing in with your existing Google account, for example, doing so requires you to allow sharing of your Twitter/X profile info (assuming you still have one) and account settings. You also give permission to the app to then follow and unfollow accounts for you, create and delete posts for you and engage with posts created by others.
I'm sure this is not news to a lot of people, but since I spend negligible amounts on time on either, it was to me. I'm still wondering how an attempt to create a Tiktok account with Google signin leads to an immediate prompt to share your Xitter profile. At this point in the process, I don't even have a TikTok account yet and they're already asking for permission to another account I may have. Absolutely nothing about this feels good.
This kind of shit is probably why I pinned this post so long ago:
infosec.exchange/@briankrebs/1…
https://infosec.exchange/@briankrebs/113493726356488467
https://infosec.exchange/@briankrebs/109880177018417627
@briankrebs Could be worse, the Chinese version of TikTok (Douyin, 抖音) has an option to give it device admin rights lol
Honestly too afraid to even look up why it could possibly ever need that
@briankrebs
My simple technique is to have one browser which is my actual person that spends money, does business
I have other google accounts[which may or maynot have accurate information], […]
@briankrebs
So that's how all those bot farms are implemented.
[…]
@briankrebs Thank you for this look at the TikTok sign-up process, as it is certainly the closest I'll ever get to signing up to TikTok.
@briankrebs
TikTok ist die SPIONAGESOFTWARE #1
[…]
@briankrebs
^ This is madness.
@briankrebs
cartels for 500, Alex
@briankrebs
"Just say NO"
So just how integrated is X these days with TikTok? Sounds like I need to pay more attention there.
@briankrebs That's just crazy. There's nothing more you can say about it. It's sad how social media steal your private data. And then with an announcement. But let's be honest: the average user […]
────
────
