Thread by @fs0c131y

Worried about a TikTok ban? Americans are now flocking to Xiaohongshu (REDnote), another Chinese app.

Spoiler: Yes, it tracks its users.

Time to dive in! ⬇️

When creating an account, you must verify your phone number by entering a code received via SMS.

The request sent to Xiaohongshu's server includes your phone number (of course), along with your IDFA and IDFV.

What’s an IDFA? The Identifier for Advertisers (IDFA) is a unique device ID assigned by Apple to every iOS device.

Many actors, like data brokers, use it to profile you, track your location, and more.

https://x.com/fs0c131y/status/1876975966334964076

When the user is activated, both the IDFA and IDFV are sent again.

Because why send it once when you can send it twice, right?

Nearly every request sent to Xiaohongshu's servers includes the Xy-Common-Params header, which contains:
- Device ID
- Device Fingerprint
- Device Model
- Language
- Platform
- Teenager Status
- Timezone
- And more...

During the process, your device information is also sent to Xiaohongshu's servers, enabling them to fingerprint your device.

This request includes:
- RAM size
- Boot time
- IP
- Carrier
- Country
- OS version
- HW model
- Timezone
- Language
- IDFA (yes, again!)
- Disk size

Spending just 10 minutes on Xiaohongshu is enough to conclude that this app tracks user behavior and sends device information to its servers.

https://x.com/fs0c131y/status/1879298068702724568

Where is the information sent aka where are the server located?

They use Tencent Cloud CDN, which makes sense for a Chinese app.

Spoiler: User tracking is widespread across apps, no matter their origin.

It threatens privacy and can pose national security risks.

The Gravy leak shows the dangers of centralizing massive amounts of data.

https://x.com/fs0c131y/status/1876975966334964076

Why is my IDFA all zeros in the screenshots?

Because I disabled "Personalized Ads" in iOS.

This entire thread focuses on iOS, but it applies equally to Android. The Android equivalent of IDFA is called AAID.

Technical note: If you want to give it a look, hooking this class is a good start

Four years ago, I analyzed the data TikTok was transmitting, wrote a series of articles about it, and ultimately found myself testifying before a U.S. congressional committee.

baptisterobert.com/posts/tiktok-l…