When TikTok users enter a website through a link on the app, TikTok inserts code that can monitor much of their activity on those outside websites, including their keystrokes and whatever they tap on the page, according to new research shared with Forbes. The tracking would make it possible for TikTok to capture a user’s credit card information or password.
TikTok has the ability to monitor that activity because of modifications it makes to websites using the company’s in-app browser, which is part of the app itself. When people tap on TikTok ads or visit links on a creator’s profile, the app doesn’t open the page with normal browsers like Safari or Chrome. Instead it defaults to a TikTok-made in-app browser that can rewrite parts of web pages.
TikTok can track this activity by injecting lines of the programming language JavaScript into the websites visited within the app, creating new commands that alert TikTok to what people are doing in those websites.
“This was an active choice the company made,” said Felix Krause, a software researcher based in Vienna, who published a report on his findings Thursday. “This is a non-trivial engineering task. This does not happen by mistake or randomly.” Krause is the founder of Fastlane, a service for testing and deploying apps, which Google acquired five years ago.
Tiktok strongly pushed back at the idea that it’s tracking users in its in-app browser. The company confirmed those features exist in the code, but said TikTok is not using them.
The code injected into websites through TikTok’s in-app browser, according to Krause.
FELIX KRAUSE
“Like other platforms, we use an in-app browser to provide an optimal user experience, but the Javascript code in question is used only for debugging, troubleshooting and performance monitoring of that experience — like checking how quickly a page loads or whether it crashes,” spokesperson Maureen Shanahan said in a statement.
The company said the JavaScript code is part of a third-party software development kit, or SDK, a set of tools used to build or maintain apps. The SDK includes features the app does not use, the company said. TikTok did not answer questions about the SDK, or what third party makes it.
While Krause’s research reveals the code companies including TikTok and Facebook parent Meta are injecting into websites from their in-app browsers, the research does not show that these companies are actually using that code to collect data, send it to their servers or share it with third parties. Nor does the tool reveal if any of the activity is tied to a user’s identity or profile. Even though Krause was able to identify a few specific examples of what the apps can track (like TikTok’s ability to monitor keystrokes), he said his list isn’t exhaustive and the companies could be monitoring more.
The new research follows a report last week by Krause about in-app browsers, which focused specifically on Meta-owned apps Facebook, Instagram and Facebook Messenger. WhatsApp, which the company also owns, appears to be in the clear because it doesn’t use an in-app browser.
Krause on Thursday also released a tool that lets people check if the browser they are using injects any new code into websites, and what activity the company might be monitoring. To use the tool to check Instagram’s browser, for example, send the link InAppBrowser.com to a friend in a direct message (or have a friend DM you the link). If you click on the link in the DM, the tool will give you a rundown of what the app is potentially tracking — though the tool uses several developer terms and may be difficult to decipher for non-coders.
For his new research, Krause tested seven iPhone apps that use in-app browsers: TikTok, Facebook, Facebook Messenger, Instagram, Snapchat, Amazon and Robinhood. (He did not test the versions for Android, Google’s mobile operating system.)
Of the seven apps Krause tested, TikTok is the only one that appears to monitor keystrokes, he said, and seemed to be monitoring more activity than the rest. Like TikTok, Instagram and Facebook both track every tap on a website. Those two apps also monitor when people highlight text on websites.
The company said the JavaScript code is part of a third-party software development kit, or SDK, a set of tools used to build or maintain apps. The SDK includes features the app does not use, the company said. TikTok did not answer questions about the SDK, or what third party makes it.
While Krause’s research reveals the code companies including TikTok and Facebook parent Meta are injecting into websites from their in-app browsers, the research does not show that these companies are actually using that code to collect data, send it to their servers or share it with third parties. Nor does the tool reveal if any of the activity is tied to a user’s identity or profile. Even though Krause was able to identify a few specific examples of what the apps can track (like TikTok’s ability to monitor keystrokes), he said his list isn’t exhaustive and the companies could be monitoring more.
The new research follows a report last week by Krause about in-app browsers, which focused specifically on Meta-owned apps Facebook, Instagram and Facebook Messenger. WhatsApp, which the company also owns, appears to be in the clear because it doesn’t use an in-app browser.
Krause on Thursday also released a tool that lets people check if the browser they are using injects any new code into websites, and what activity the company might be monitoring. To use the tool to check Instagram’s browser, for example, send the link InAppBrowser.com to a friend in a direct message (or have a friend DM you the link). If you click on the link in the DM, the tool will give you a rundown of what the app is potentially tracking — though the tool uses several developer terms and may be difficult to decipher for non-coders.
For his new research, Krause tested seven iPhone apps that use in-app browsers: TikTok, Facebook, Facebook Messenger, Instagram, Snapchat, Amazon and Robinhood. (He did not test the versions for Android, Google’s mobile operating system.)
Of the seven apps Krause tested, TikTok is the only one that appears to monitor keystrokes, he said, and seemed to be monitoring more activity than the rest. Like TikTok, Instagram and Facebook both track every tap on a website. Those two apps also monitor when people highlight text on websites.
Meta did not answer specific questions related to the tracking, but said in-app browsers are “common across the industry.” Spokesperson Alisha Swinteck said the company’s browsers enable certain features, like allowing autofill to populate properly and keeping people from being redirected to malicious sites. (However, browsers including Safari and Chrome have those features as well.)
“Adding any of these kinds of features requires additional code,” Swinteck said in a statement. “We have carefully designed these experiences to respect users’ privacy choices, including how data may be used for ads.”
The code that Instagram inject into websites, according to Krause.
FELIX KRAUSE
Meta also said the script names featured in the tool can be misleading because they are technical Javascript terms that people may misunderstand. For example, “message” in this context refers to code components communicating with each other, not personal text messages.
Snapchat seemed to be the least data-hungry. Its in-app browser didn’t appear to inject any new code into web pages. However, apps have the ability to hide their JavaScript activity from websites (like Krause’s tool) because of an operating system update Apple made in 2020. So it’s possible that some apps are running commands without detection. Snapchat didn’t respond to a request for comment on what activity, if any, is monitored on its in-app browser.
Source: Richard Nieva | Forbes.com