Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

11–20 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#11

Post by WrtCdEvrydy »

gentleman11 wrote: post #2

I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin. I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

this is weird, you usually can't past data from clipboard (part of the browser sandbox). copying into the clipboard is free, pasting is not.

Edit: This seems to be the app TikTok, not a website.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#12

Post by _6fmb »

adamhearn wrote: post #6
_6fmb wrote: post #3

Hopefully we can turn this off, this is going to destroy usability be very annoying.

You mean so you can snoop from the user without being detected?

There are a lot of valid usecases for clipboard saving, I don't have an iOS app but I run CopyClip which would be kinda ruined by this "feature".

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#14

Post by csa »

beamatronic wrote: post #4

Why does any app have access to the clipboard? Seems like a big security hole.

In order to know when you should enable the paste option.

It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#15

Post by harpastum »

It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification.

If TikTok is actually constantly loading the clipboard, that's obviously terrible. I'd bet this behavior is gone by the next release, and that shows how useful this new notification is.

Same issue with notes from that app's developer saying what's going on and how they will fix it: https://twitter.com/ecormany/status/1275903947899797505

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#16

Post by dan-robertson »

mobilio wrote: post #7

hm... seems that privacy issue: https://developer.apple.com/app-store/review/guidelines/#pri... can led to ban from AppStore

Fortunately for tiktok, such rules only apply to small apps. They will probably get a polite phone call from a VP asking them to please stop doing that but noting more.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#17

Post by riskable »

mobilio wrote: post #7

hm... seems that privacy issue: https://developer.apple.com/app-store/review/guidelines/#pri... can led to ban from AppStore

Oh yes! Please! I have wild fantasies about TikTok being banned like that.

"Why was TikTok banned?"

"Because the violated the basic capitalistic principal of existing not to make money but to amass a Nazi-like ledger/database of every person in the world on behalf of a nation state."

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#18

Post by speedyapoc »

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code.

Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#19

Post by selsta »

riskable wrote: post #8
gentleman11 wrote: post #2

I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin. I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

The problem is that iOS doesn't differentiate between a call that merely checks for the presence of a clipboard entry (e.g. so you can enable "Paste" in a menu/submenu) and actually copying the contents of the clipboard. The workaround (for legitimate apps) is to simply always keep that "Paste" option enabled--even if the clipboard is empty. That way you won't freak out your users and only suffer the most minor of us…

iOS differentiates between this since iOS 10:

https://developer.apple.com/documentation/uikit/uipasteboard...

Also iOS 14 has new clipboard related APIs to further check the content without actually accessing it.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#20

Post by moonchild »

gentleman11 wrote: post #2

I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin. I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

It is a risk. There's an easier solution, though.

about:config -> dom.event.clipboardevents.enabled=false

Post reply on HN