IIRC Apple syncs (or can sync) your clipboard data to the cloud, which is an issue if you’re copying passwords.
Popular iPhone and iPad Apps Snooping on the Pasteboard
71–80 of 107 posts
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#72The pasteboard API is essentially the same in iOS as it is in macOS. Which means it's an api that was likely designed more than 20 years ago. Because of that, it was not designed for the user-hostile app world we live in, where developers will harness any api that can leak data about the user. A solution to this is to re-design this api so that it allows developers to query for specific matches, but requires user-act…
> A solution to this is to re-design this api so that it allows developers to query for specific matches, but requires user-action to unlock them I.e. I can passively ask "does the clipboard contain a photo?" or "does the clipboard contain a url in the *.facebook.com domain?" but in order to get the contents I have to prompt the user to manually paste.
I fully expect apps to try to leak information bit-by-bit to the greatest possible extent.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#73Earlier quoted context omitted.
I don’t disagree but the overflowing of permission prompts is how we get people just clicking Yes to everything. There is a balance. Location services are worth of a permission, but the clipboard seems a bit on the trivial side of things. Then again, people paste passwords, so...
The permissions can be unidrectional, e.g. password manager grants permission to a specific app for the next N seconds. Similar to "add photo" permission.
How would the password manager know which app you’re going to paste the password into?
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#74Earlier quoted context omitted.
I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?
1. Upon opening, app for service XYZ sees your clipboard has the URL www.xyz.com/whatever and offers to navigate to that link within the app, saving the user from having to find it again in the app or paste the URL in the search bar (if there is a search bar). 2. When using 2FA, 1Password will automatically write your one time code to the clipboard so it can easily be pasted. As a convenience, after 45 seconds or so…
- Writing to the clipboard is not the same as reading it.
- Apps can and should let the user paste it themselves. (Examples #1 and #3 offer only slight convenience at the cost of user privacy and security.)
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#75Earlier quoted context omitted.
I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?
I guess what if the app needs to implement an "enhanced" paste that's different from the system default paste functionality? I believe the photo picker has had a similar evolution. In the early days of iPhone OS apps used the system-default photo picker, and nowadays it's for apps to use that in favor of reimplementing.
Which is unfortunate, because the latter requires full access to photos.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#76What are the security implications for password managers here - not copy/pasting any passwords?
iOS has a system-level interface for password managers so that the passwords are accessed without using the pasteboard.
This doesn’t work everywhere; there’s been more than one occasion that I’ve had to copy/paste a password out of Settings because the system hasn’t detected a password field or gives me incorrect suggestions.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#77What are the security implications for password managers here - not copy/pasting any passwords?
iOS has a system-level interface for password managers so that the passwords are accessed without using the pasteboard.
Which isn't foolproof. I just tried to change my Apple ID password[1], and the password manager will only auto-fill the password field, not the verify password field, even if you invoke it with the cursor in the verify field. The only option is to copy and paste the password (or manually copy a 64 character password).
[1] I'm fairly sure I've copy-and-pasted my Apple ID password recently - I had to reauthorise my Apple ID (I think I was changing payment details), and there was no option to use the password manager (might be pre-iOS 13, so I'm not sure if that's still the case).
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#78One good way to find these apps is that they’ll often throw up a “Pasting…” alert if you have clipboard sync enabled, as it tries to fetch your Mac’s pasteboard contents.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#79Earlier quoted context omitted.
A few years ago, Pasteboard was a popular way of how advertising SDKs communicated between their own instances in different apps on iOS. It allowed those SDKs to determine which apps were installed on the phone and combine/mine user profile data across apps. Meaning: if you entered a social login in one app, others immediately got your demographic data. I assumed Apple plugged this hole by now :/
Would that mess up things users actually copied?
You can read the pasteboard without messing it up, and then replace the contents back to what they used to be.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#80IIRC Apple syncs (or can sync) your clipboard data to the cloud, which is an issue if you’re copying passwords.
Password apps should enable this option to disable the behavior: https://developer.apple.com/documentation/uikit/uipasteboard...