Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

21–30 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#21

Post by remmargorp64 »

_6fmb wrote: post #12
adamhearn wrote: post #6

Earlier quoted context omitted.

You mean so you can snoop from the user without being detected?

There are a lot of valid usecases for clipboard saving, I don't have an iOS app but I run CopyClip which would be kinda ruined by this "feature".

Then there should be a setting that has to be manually approved to allow the clipboard interactivity feature.

I use a password manager on my iPhone and I am copying and pasting my passwords all the time. If some random app is scraping my clipboard silently and sending the data to a third party, that means my passwords are compromised. I am very much NOT OK WITH THIS.

Keep in mind, this permission should be fundamentally different than the permissions for just manually copying and pasting. I don't want to have to deal with permissions to "allow clipboard use" that I have to approve every time I want to paste something. That would be obnoxious. I am only worried about restricting permissions for invisible passive snooping.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#22

Post by vxNsr »

Appears that a lot of third party apps are just using an older api that forces this notification to show. a lot less nefarious than it originally appears.

Seems that iOS14 offers a specific new API to check if there's something on the clipboard without actually seeing it which is what all these apps are trying to do.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#24

Post by landryraccoon »

csa wrote: post #14
beamatronic wrote: post #4

Why does any app have access to the clipboard? Seems like a big security hole.

In order to know when you should enable the paste option. It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

Couldn't IOS just have a peek API that tells the application if the clipboard is empty or not without revealing it's contents?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#25

Post by m0xte »

csa wrote: post #14
beamatronic wrote: post #4

Why does any app have access to the clipboard? Seems like a big security hole.

In order to know when you should enable the paste option. It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

Perhaps the destination should define whether or not you can paste into it and the OS can provide that option instead. This looks like a violation of “tell, don’t ask”.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#26

Post by RandallBrown »

ferest wrote: post #13

running old app on new OS can cause unpredicted behavior is normal, and here is assuming it is not iOS14 bug

iOS 14 added this feature (the clipboard notification) to catch this type of behavior.

It's possible that TikTok isn't doing anything and this is a bug, but it's more likely they're using the clipboard in a way they shouldn't.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#27

Post by RandallBrown »

landryraccoon wrote: post #24
csa wrote: post #14

Earlier quoted context omitted.

In order to know when you should enable the paste option. It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

Couldn't IOS just have a peek API that tells the application if the clipboard is empty or not without revealing it's contents?

They've had one for several years.

https://developer.apple.com/documentation/uikit/uipasteboard...

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#28

Post by [deleted] »

landryraccoon wrote: post #24
csa wrote: post #14

Earlier quoted context omitted.

In order to know when you should enable the paste option. It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

Couldn't IOS just have a peek API that tells the application if the clipboard is empty or not without revealing it's contents?

[deleted]

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#29

Post by _bxg1 »

harpastum wrote: post #15

It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification. If TikTok is actually constantly loading the clipboard, that's obviously terrible…

> There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button)

People keep saying this but I've never seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing every app to be reading my clipboard at all times.

It's inexcusable to me that there isn't a permissions prompt for this. Two of my most common types copy-pasted strings are URLs and passwords.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#30

Post by radomysisky »

speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

Should we still be giving the benefit of the doubt to a Chinese-owned honeypot in 2020?
Post reply on HN