What’s the concern around TikTok and passwords?
There are some concerns around whether TikTok might have access to users’ passwords or other sensitive information. This stems from the fact that TikTok collects a significant amount of data from its users. According to TikTok’s privacy policy, the app collects information like your username, password, email address, phone number, videos you watch, comments you post, and more [1]. Some experts argue this gives TikTok an extensive profile of each user.
With access to so much personal data, there are worries that TikTok could obtain passwords and other sensitive information entered by users. However, TikTok claims it does not actually have access to users’ passwords. Still, the breadth of data collection makes some security experts uneasy about what the platform may be capable of accessing.
Does TikTok actually see your passwords?
No, TikTok does not have direct access to passwords stored in your phone or other apps. According to research from The Guardian, while TikTok’s in-app browser has the capability to monitor keystrokes, including passwords typed on that browser, it does not actually capture or see your passwords entered in other apps or your phone’s password manager.
TikTok’s in-app browser is designed to only operate within the TikTok app itself. It does not have access outside of its own “walled garden” environment. So any passwords, credit cards, or other sensitive information you may enter directly into the TikTok app could theoretically be monitored. However, anything stored in your iOS or Android system, like your saved WiFi passwords, bank passwords, or passwords stored in third party apps like Facebook or Gmail, cannot be seen by TikTok.
Some researchers have claimed TikTok’s potential keystroke monitoring abilities could extend beyond its in-app browser, but these claims have not been substantiated. Overall, while in-app tracking is concerning, there is no evidence currently that TikTok can actually access your broader passwords, accounts, or data stored securely on your device.
What user data does TikTok collect?
TikTok collects a significant amount of user data including username, profile bio, posts, contacts, location information, and more. According to a 2020 class action lawsuit, TikTok accessed Android users’ MAC addresses, allowing the app to identify and track devices https://beebom.com/tiktok-user-data-collection-android-report/. TikTok also collects data on users’ interests and habits through their interactions with videos and ads. The app accesses users’ clipboards frequently, raising concerns about collection of sensitive data like passwords or emails https://www.coursesidekick.com/information-systems/1691044. While the full extent of TikTok’s data harvesting is unknown, it likely includes a broad range of information shared willingly or unwittingly by users.
Does TikTok store passwords you enter on TikTok?
TikTok likely stores any passwords you enter directly into their platform, such as when logging into your TikTok account. According to TikTok’s help center, users have the option to save their TikTok login information so they don’t have to re-enter it every time. This indicates TikTok does store passwords locally if users opt into that feature.
However, there is no evidence that TikTok accesses or extracts passwords you may have saved in third-party password managers or browsers like Chrome. TikTok only has access to passwords specifically entered into their own platform. They do not have widespread access to other passwords on your device.
Could TikTok get passwords through malware?
Some people have speculated that TikTok could theoretically collect passwords through malware installed on a user’s device. However, there is currently no evidence that TikTok is actually engaging in this type of malicious data collection.
Malware refers to malicious software that is covertly installed on a user’s device without their knowledge or consent. Hypothetically, malware could be designed to monitor keystrokes or access sensitive information like passwords stored on a device.
However, major app stores like the Apple App Store and Google Play Store have security review processes in place to detect malware before an app is published. Additionally, independent security researchers and journalists actively analyze popular apps like TikTok and have not found clear evidence of secret malware capabilities.
While no app is 100% immune from potential vulnerabilities, there is currently no proof that TikTok is stealing passwords or other sensitive data through malware on iPhones, Androids, or other devices. Users should stay vigilant, but not panic about unsubstantiated rumors. Regularly updating devices and apps is the best way to ensure protection against any future malicious behavior.
Overall the concerns about TikTok and malware appear largely hypothetical at this point, with no smoking gun evidence that users’ passwords are being compromised in this way.
What Access Does TikTok Have on iPhones?
On iPhones, TikTok actually has fairly limited access compared to Android. This is due to Apple’s tight control over app permissions on iOS devices.
By default, TikTok can access basic information like your user ID, profile info, contacts list, and any content you post. However, TikTok cannot access your photos, videos, passwords, or other sensitive data without explicit user permission.
This is because iOS requires apps like TikTok to ask for permission to access certain features like the camera, microphone or photos. Users have to manually enable these permissions in iOS settings. As per a discussion on Apple forums, TikTok cannot get access to iPhone photos without the user granting access in settings.
Additionally, Apple does not allow apps like TikTok to run continuously in the background on iOS. So TikTok’s ability to passively monitor user activity is restricted compared to Android. Overall, Apple’s tighter app sandboxing provides iPhone users more protection regarding data access.
What access does TikTok have on Android?
When installed on Android devices, TikTok requests an extensive amount of permissions and access to user data and device functionality. This includes access to your contacts, location data, microphone, camera, and network connections (1).
Compared to the iOS version, the Android app is able to gain broader access to data and functions on your phone. A key difference is that on Android, TikTok is able to access your entire clipboard. This means it can read anything you copy and paste on your device, including sensitive information like passwords (2).
TikTok also has the ability to retrieve running apps and data about other installed apps on your Android phone. This could allow it to detect what other apps you use and glean more insights about you (3).
Overall, the Android version provides TikTok with deeper access to your personal data, contacts, device contents and usage compared to iOS. Users should be aware of the extensive permissions granted to the app on Android.
Should I be concerned about TikTok and my passwords?
Users don’t need to be overly concerned that TikTok itself has access to their passwords and other sensitive data entered outside of the TikTok app. However, it’s still important to practice general password security and be aware of potential risks.
TikTok likely doesn’t have direct access to passwords you use on other sites and services. TikTok collects certain user data through its app, but there is no evidence that it secretly obtains passwords, financial information, or other highly sensitive data entered elsewhere.
That said, experts recommend against reusing the same passwords across multiple apps and services. Using unique, complex passwords for each account helps minimize risks if any one service experiences a breach. Enabling two-factor authentication provides an additional layer of protection.
Users should also be cautious of phishing attempts or suspicious links claiming to be from TikTok. As with any site, users should verify the source of any messages requesting personal information or passwords.
In general, it’s wise to limit the sensitive information provided to any app. But users don’t need to delete TikTok out of fear it is secretly stealing passwords and data entered outside of the app itself.
How can I keep my passwords safe from TikTok?
There are a few ways to help keep your passwords secure and prevent unauthorized access to your accounts from TikTok or other apps:
Use a password manager. A password manager like 1Password or LastPass can generate and store strong, unique passwords for each of your accounts. This helps avoid password reuse, which makes accounts more vulnerable. The master password for your password manager should be very strong (TikTok Help Center, 2022).
Enable two-factor authentication (2FA). Activating 2FA adds an extra layer of security, requiring both your password and a secondary step like an SMS code or authentication app. Enable 2FA on important accounts whenever possible (Tiktok, 2022).
Create strong, unique passwords. Avoid reusing passwords across accounts. Use a mix of letters, numbers and symbols to make passwords harder to crack. Consider passphrases for greater security (Tiktok, 2022).
Carefully review permissions when logging into accounts through TikTok. Only allow access to non-sensitive accounts.
Frequently change passwords, especially for high-value accounts. This limits the damage if a password is somehow compromised.
Avoid entering passwords directly into TikTok. Instead, use the built-in browser to log into accounts.
Key takeaways
The main points are that while TikTok doesn’t directly access passwords you’ve entered elsewhere, it does collect a significant amount of user data that could potentially be misused. Given this, it’s wise to practice general password safety precautions.
Specifically, TikTok doesn’t actually see or store passwords you’ve entered in other apps or sites. However, it collects a wide range of user data including location, messages, contacts, clipboard contents, metadata, and more. TikTok claims it doesn’t misuse this data, but its privacy protections have come into question before.
So while TikTok itself likely doesn’t access your passwords directly, the extensive user data it gathers could potentially be exploited by bad actors. Given this, it’s a good idea to use unique, complex passwords, enable two-factor authentication where possible, and avoid entering sensitive passwords while using TikTok. Practicing general password hygiene and security is advisable.
In summary, TikTok does not directly obtain your passwords but does collect substantial personal data. Taking precautions with your passwords and enabling security options is recommended not just for TikTok but for good digital hygiene overall.
