TikTok requests access to devices on local network

[1] https://en.wikipedia.org/wiki/Multicast_DNS

You’ll need a router/firewall and an AP that are both VLAN-aware. I personally use an EAP225 and some eBay industrial PC running freebsd.

To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.

That's a design error on the UI side. An app should not have read access to the clipboard, it should have the ability to accept data from the clipboard when the user pastes it.

It's annoying because it's not like other permissions, where you can ask the OS to prompt the user, and check if the user granted it or not, but it's some special permission. If the user, by mistake because it doesn't know that it's needed, doesn't give it one time it's impossible to ask again, and the app doesn't have a way to know that the permission is not granted. It's just things that the customer service has to handle, and that is bad.

Sure, right to ask a permission, so make it like a regular permission as the location permission.

    Making an outgoing TCP connection — yes

    Listening for and accepting incoming TCP connections — no

    Sending a UDP unicast — yes

    Sending a UDP multicast — yes

    Sending a UDP broadcast — yes

    Receiving an incoming UDP unicast — no

    Receiving an incoming UDP multicast — yes

    Receiving an incoming UDP broadcast — yes

    And finally usage of Bonjour operations.

That opens new questions; for example, what's a "custom" DNS query? One that doesn't use mDNSResponder (or whatever iOS uses right now)?

The first possibility that comes to my mind would be sniffing Ethernet MAC addresses because it could be done without any sort of device-specific support built in to the app. Assuming your local devices’ manufacturers are following Da Rulez, the first part of their MAC address usually tells you the company, and the second part tends to be individualized/serialized.

That would, for example, let TikTok derive when certain users are together IRL if they both show up scan-adjacent to a unique MAC. Or maybe it could let them derive multiple accounts belonging to a single person if one is used on VPN-only to discuss political or personal topics that person might not want associated with their IRL identity.

As for Tick Tock it’s obviously spyware meant for direct user identification. How anyone can use it when it’s uploading their biometric information (face, voice) to the CCP is beyond stupidity.

You’re asking a forum of power users/creators, where a loud minority completely unironically still use desktop & laptop computers for activities besides work. The only people on earth less understanding (intentionally or not) of consumer behavior are the Sentinelese.