Accuweather — com.yourcompany.TestWithCustomTabs
Off topic. I can't imagine how did they shipped this app with this BundleId.
Popular iPhone and iPad Apps Snooping on the Pasteboard
31–40 of 107 posts
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#32What are the security implications for password managers here - not copy/pasting any passwords?
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#33What are the security implications for password managers here - not copy/pasting any passwords?
iOS has a system-level interface for password managers so that the passwords are accessed without using the pasteboard.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#34I wouldn't be surprised if the apps themselves were not directly responsible here -- that is, the code that's written directly by the app developers. Instead, it may very well be be some analytics/marketing SDK that has been included in the app because of a business request. These have no privilege separation: they run their code in the same context as the code that the app developers wrote. (Consider the example of…
"We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to make sure it's not doing bad things." No.
Ok, well, say "No" all you want but this totally happens, only the perpetrators are not nearly so clue-ful as to realize they've shipped a trojan. There are "helpful" SDKs out there whose ulterior purpose is to collect user data without the app author's knowledge. This is one reason I'm very wary about what apps I'll install... it's not enough to trust the app author if they include 3rd party code.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#35Earlier quoted context omitted.
I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?
The app might be implementing the paste function. The most common use case of copying and pasting text could probably be hidden inside the standard text fields, but consider images, sounds, or custom data types. The app needs to grab these off the clipboard and do something with them and will be triggering the action from some custom user interface element. Even for text, a terminal emulator or word processor is not…
The app doesn't need to grab anything until the users selects paste. The added latency would be miniscule.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#36What are the security implications for password managers here - not copy/pasting any passwords?
iOS has a system-level interface for password managers so that the passwords are accessed without using the pasteboard.
when that works... pretty sure the fallback is to copy/paste, unless copy/paste from password manager apps also bypasses the clipboard
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#37Earlier quoted context omitted.
Should be a permission.
I don’t disagree but the overflowing of permission prompts is how we get people just clicking Yes to everything. There is a balance. Location services are worth of a permission, but the clipboard seems a bit on the trivial side of things. Then again, people paste passwords, so...
> Then again, people paste passwords, so.
It’s more serious than that, current security best practice is telling everybody to use a password manager. People are being told that pasting passwords is “the right way to do things”. And that behaviour (at least for me) has morphed into keeping account numbers, credit card numbers, and other important private information in the password manager, and copy pasting those when I need to.
(1Password on Mac seems to have a trick where it empties the clipboard after a certain amount of time, I’ve noticed that occasionally when a password I’d copied a little while ago isn’t still in the clipboard when I try to paste it. I haven’t been quite curious enough to look into it. Yet...)
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#38Earlier quoted context omitted.
"We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to make sure it's not doing bad things." No.
Ok, well, say "No" all you want but this totally happens, only the perpetrators are not nearly so clue-ful as to realize they've shipped a trojan. There are "helpful" SDKs out there whose ulterior purpose is to collect user data without the app author's knowledge. This is one reason I'm very wary about what apps I'll install... it's not enough to trust the app author if they include 3rd party code.
Pretty sure at least some of those are “helpful” in the sense of “this is one of the ways we make money, by installing someone else’s sdk in our game and getting paid for it, while not looking too carefully at what it’s doing to our users”. And I’d be astounded if various Facebook/Google/Twitter SDKs (including things like Fabric/Crashlytics and Google Analytics) haven’t done this in the past even if they’re not doing it now. Surveillance capitalists gonna surveil...
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#39Something that confuses me: Windows app can do this. Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes. The API is ancient, well documented, and provides no feedback when it's being used. And some apps indeed use it, one obvious one is remote desktop apps use it to "sniff" what's in the clipboard to mirror it along. Is there a reason whatever s…
> Is there a reason whatever security trade offs are OK in Windows, but not on a phone? Obviously the Windows APIs are far older and are from a time when there wasn't the same concept of untrusted code. Also, people do tend to install more random software on their phones than their desktops and laptops in my experience. Someone will install a funny Chinese app in the pub based on a recommendation from a friend. They…
Webpages have been able to read your clipboard for decades without prompting you and was only taken seriously recently.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#40Is there a MacOS utility that clears the pasteboard N minutes after its last content change?
not sure, but i do seem to remember that passwords copied from the “passwords” screen in system preferences get removed after a minute or so... so that functionality seems to exist in some form... (if i am remembering correctly that is)
1Password does this as well.
I just looked on iOS, it’s got an option to “clear clipboard” which says “Clears any item copied from 1Password to the clipboard after 90 seconds”
I notice that occasionally, but it seems to be a reasonable compromise of security over annoyingness, in the absence of proper access controls to the clipboard contents...