,
21 tweets,
9 min read
Read on Twitter
It’s time for a thread about #ZAO, the new Chinese app which blew up since Friday. The app is accessible only to Chinese people for the moment but I managed to get an account ;)
This "AI facial" app allows you to add your face on predefined clip.
1/n
This "AI facial" app allows you to add your face on predefined clip.
1/n
Let’s start by the beginning, as far as I can see, #ZAO is NOT uploading your camera roll to their servers.
Yes, they upload the photo you use to create the deep fake to their server (which makes sense)
2/n
Yes, they upload the photo you use to create the deep fake to their server (which makes sense)
2/n
As said this morning and during the #FaceApp episode, for privacy reasons, don’t upload your face to a random app.
Yes, this is cool but once your face is uploaded you lose your rights on it. They can do whatever they want
3/n
Yes, this is cool but once your face is uploaded you lose your rights on it. They can do whatever they want
3/n
This is what you can find in their privacy policy:
"Exceptions for authorization of consent […] 4. It is difficult to obtain your own consent to protect the personal rights and interests of the personal information subject or other individuals' lives and property;"
4/n
"Exceptions for authorization of consent […] 4. It is difficult to obtain your own consent to protect the personal rights and interests of the personal information subject or other individuals' lives and property;"
4/n
They will give your face to the Chinese authorities if they ask
5/n
5/n
This is a Chinese app in the User Agreement they are talking about national security
7/n
7/n
Your video are not stored on your phone, they are stored online. No auth required, if you have the direct link you can access it
9/n
9/n
You can also access the predefined videos provided by the app:
- zao.momocdn.com/zaovideo/10/CA…
- zao.momocdn.com/zaovideo/E4/92…
10/n
- zao.momocdn.com/zaovideo/10/CA…
- zao.momocdn.com/zaovideo/E4/92…
10/n
No auth required to access your photo too…
11/n
11/n
As a lot of apps, #ZAO is using an analytic solution in order to track the user inside the app.
The solution they use is provided by a Chinese company called GrowingIO
12/n
The solution they use is provided by a Chinese company called GrowingIO
12/n
#ZAO is sending to GrowingIO some info:
- Phone model
- Connectivity type
- OS
- Connectivity type
- imei
- …
13/n
- Phone model
- Connectivity type
- OS
- Connectivity type
- imei
- …
13/n
Worth saying, all the network requests done by #ZAO with their backend immomo.com use HTTPS and sometimes the content is encrypted
14/n
14/n
The « #ZAO - Support and Help » page are stored on a website called ai-indestry.com
15/n
h5.ai-indestry.com/zao/static-pag…
15/n
h5.ai-indestry.com/zao/static-pag…
The company behind #ZAO is called #MOMO. They are listed on the NASDAQ since December 11, 2014 $MOMO
immomo.com/aboutus.html
17/n
immomo.com/aboutus.html
17/n
We can regret the fact that #ZAO and GrowingIO are not using SQLCipher to encrypt their databases.
18/n
18/n
To be continued, I have work to do :D
