Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular iPhone and iPad Apps Snooping on the Pasteboard

mysk.blog

Post reply on HN
Print view View original

51–60 of 107 posts

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#51

Post by cortesoft »

izacus wrote: post #22
wool_gather wrote: post #17

I wouldn't be surprised if the apps themselves were not directly responsible here -- that is, the code that's written directly by the app developers. Instead, it may very well be be some analytics/marketing SDK that has been included in the app because of a business request. These have no privilege separation: they run their code in the same context as the code that the app developers wrote. (Consider the example of…

A few years ago, Pasteboard was a popular way of how advertising SDKs communicated between their own instances in different apps on iOS. It allowed those SDKs to determine which apps were installed on the phone and combine/mine user profile data across apps. Meaning: if you entered a social login in one app, others immediately got your demographic data. I assumed Apple plugged this hole by now :/

Would that mess up things users actually copied?

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#52

Post by jcampbell1 »

kennywinker wrote: post #28

The pasteboard API is essentially the same in iOS as it is in macOS. Which means it's an api that was likely designed more than 20 years ago. Because of that, it was not designed for the user-hostile app world we live in, where developers will harness any api that can leak data about the user. A solution to this is to re-design this api so that it allows developers to query for specific matches, but requires user-act…

A stop gap solution is to add an api for “secure copy” that 1Password and the like can implement which makes it unreadable without a user initiated paste. This would take far less time to implement from Apple’s side.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#54

Post by snailmailman »

banana_giraffe wrote: post #25

Something that confuses me: Windows app can do this. Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes. The API is ancient, well documented, and provides no feedback when it's being used. And some apps indeed use it, one obvious one is remote desktop apps use it to "sniff" what's in the clipboard to mirror it along. Is there a reason whatever s…

Windows itself can do this. Win+V will now will up clipboard history.

I had no idea it existed initially, but until i disabled it there was a nice easy-access list of all of my recently used passwords. I assume other programs can't access that. But I don't want Microsoft syncing all my clipboard history to the cloud. No thanks.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#55

Post by Marsymars »

woobar wrote: post #31

Accuweather — com.yourcompany.TestWithCustomTabs Off topic. I can't imagine how did they shipped this app with this BundleId.

Presumably it got developed as such, and it never got prioritized before release.

"Okay we've finished all the must-haves just in time for our release deadline but the name for our app in our code isn't really configured correctly."

"How long will it take to fix?"

"Maybe a week to update our CI environments and be confident that there aren't any regressions related to dependencies on the thing that we're changing, but we can also fix some other issues in parallel."

"What effect will changing it have?"

"Well it will conform with best practice and won't confuse future developers."

"What user-facing change will it have?"

"None."

"Nope, not worth delaying release by a week for."

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#56

Post by Marsymars »

bigiain wrote: post #37
toyg wrote: post #21

Earlier quoted context omitted.

I don’t disagree but the overflowing of permission prompts is how we get people just clicking Yes to everything. There is a balance. Location services are worth of a permission, but the clipboard seems a bit on the trivial side of things. Then again, people paste passwords, so...

> Then again, people paste passwords, so. It’s more serious than that, current security best practice is telling everybody to use a password manager. People are being told that pasting passwords is “the right way to do things”. And that behaviour (at least for me) has morphed into keeping account numbers, credit card numbers, and other important private information in the password manager, and copy pasting those when…

> 1Password on Mac seems to have a trick where it empties the clipboard after a certain amount of time, I’ve noticed that occasionally when a password I’d copied a little while ago isn’t still in the clipboard when I try to paste it. I haven’t been quite curious enough to look into it. Yet...

I think this is pretty standard. KeePass makes it immediately obvious as it has a bar on the bottom of the window that starts a 12-second decrement when you copy a password.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#57

Post by keanebean86 »

jcampbell1 wrote: post #52
kennywinker wrote: post #28

The pasteboard API is essentially the same in iOS as it is in macOS. Which means it's an api that was likely designed more than 20 years ago. Because of that, it was not designed for the user-hostile app world we live in, where developers will harness any api that can leak data about the user. A solution to this is to re-design this api so that it allows developers to query for specific matches, but requires user-act…

A stop gap solution is to add an api for “secure copy” that 1Password and the like can implement which makes it unreadable without a user initiated paste. This would take far less time to implement from Apple’s side.

It's weird that apps can straight read from the clipboard at all. I would think the OS just hands the app a pointer to the data and maybe some meta data for type.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#58

Post by kccqzy »

woobar wrote: post #31

Accuweather — com.yourcompany.TestWithCustomTabs Off topic. I can't imagine how did they shipped this app with this BundleId.

I'm very surprised Apple doesn't enforce the reverse-DNS nature of these IDs and allow all sorts of jumbled strings, let alone not verifying that your in fact own the domain.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#59

Post by kccqzy »

_bxg1 wrote: post #8
acwan93 wrote: post #3

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”. I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?

I guess what if the app needs to implement an "enhanced" paste that's different from the system default paste functionality?

I believe the photo picker has had a similar evolution. In the early days of iPhone OS apps used the system-default photo picker, and nowadays it's for apps to use that in favor of reimplementing.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#60

Post by ken »

lazyjones wrote: post #7

Is there a MacOS utility that clears the pasteboard N minutes after its last content change?

Not efficiently. There's no "clipboard changed" notification on macOS.

Such a utility would have to run in the background and constantly query the clipboard. And since the clipboard basically holds a list of types and a way to ask the owning application for data, you'd have to keep waking up the clipboard owner, too, to ask it for data. Would you check every type it declares? Some applications support dozens of types.

Post reply on HN