The crowd of university students tiered upward throughout the lecture hall was unenthusiastic at best.
It was 8 a.m., though, and I was an extra-credit guest speaker, so they could be forgiven for not being engaged.
The information security program head had asked me as an alumnus to speak about common data privacy issues that non-technical people should know about. Luckily for me, TikTok had been in some hot water, so I dropped my bomb early.
"Think of the most sensitive piece of information you have ever copied and pasted on your phone," I said to the approximately 50 exhausted juniors and seniors.
"Is it a bank account password? Credit card number? Social security number?"
Some of their blank stares into the void transformed into blank stares in my general direction, so I kept going.
"Did you know that TikTok has been accessing all of that on a regular basis up until recently?"
More directed (though still blank) stares and some uncomfortable shuffling in seats. I had struck a cord.
The world's most beloved malware
When the information in the article I linked above first hit the mainstream after Apple introduced more comprehensive privacy reporting in iOS 14, I thought it was the beginning of the end for the popular app, but my naiveté had once again bested me.
Sure, TikTok stopped grabbing clipboard contents at rapid fire pace, but despite being the most overt case of data privacy violation possibly in mobile app history, at least at such scale, the behavior went largely unpunished, and is now all but forgotten by most people.
They had accomplished a degree of malicious capability that I as a red teamer could only dream of, even via malware I was authorized to deploy by a customer, and hardly anyone blinked.
As with many cut-and-dry controversies that fall flat, any slightly grayer area issues were bound to be fraught with even less productive discussion.
The government ban
When the federal government signed into law last April that TikTok would need to be sold or be banned, I once again felt like I was taking crazy pills listening to the information security community around me.
"This is a clear violation of free speech"
"Couldn't just pass a law with actual data privacy protections for citizens?"
"They should ban Facebook and Instagram and Twitter, too, but they won't because it's okay when US companies or the government snoops on people, but China bad"
I'm keeping these quotes anonymous so as to not draw a vague map around my identity, but you won't have to look far to find arguments like this yourself if you haven't seen them already.
Then, like a lighthouse in a hurricane, a beacon of logic broke through in a Hacker News comment section, my last hope for reasoned discussion:
No one I have spoken to about this has afforded me the courtesy of trying to refute or critique the conclusions that make up this line of thinking.
No one wants to think that hard.
No one wants to consider the possibility that their argument for keeping TikTok around is made in bad faith and they just don't want their favorite toy take away.
TikTok is a spy device covered in lead paint
Let's revisit this particular argument for a second:
"They should ban Facebook and Instagram and Twitter, too, but they won't because it's okay when US companies or the government snoops on people, but China bad"
This might seem like a reasonable thing to say at first glance, but the moment you apply any scrutiny to it, it falls apart.
I'd wager that hardly any one who makes this argument without implementing changes in their personal lives to protect their privacy is making it in good faith.
I doubt any substantial contingent of those holding this stance takes their personal privacy as far as I do, at the very least:
- Using Linux as a main OS on all my computers
- Running a VPN everywhere, all the time, no exceptions
- Using GrapheneOS without any Google-y shit on it anywhere in the rare cases I need it instead of a dumb phone
- Registering for accounts with burner aliases only
And most importantly:
- NOT USING THE OTHER SHITTY SOCIAL MEDIA APPS
I use Twitter (information security is primarily discussed there) and LinkedIn for work. However, you won't find either of their apps installed anywhere on any device I use or allow on my network, because I don't allow toys with lead paint into my home.
They both sit in Firefox container tabs of their very own, the cookies and browsing data for which are deleted every time I close the browser, which occurs daily.
Entertainment over reason
I fear, in short, that most users of mobile technology have come to value their own entertainment over the common good, to the extent that they can't even mentally step past their biases to see how mistaken they are.
I sure hope I am wrong.