Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

71–80 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#71
post #63

Here is an explanation from a 3rd party reddit app developer: tl;dr: Since Apple doesn't give a way to open URLs in 3rd party apps, he inspects the paste buffer for reddit URLs, but he aptly points out that he could read anything in the paste buffer if he wanted to: "Hey! I make Apollo for Reddit and a few people asked me about this and if Apollo does anything with the clipboard so I wanted to answer. Since iOS doesn…

We need an answer from TikTok not Apollo.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#72
post #59
post #52

Earlier quoted context omitted.

I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy. Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly. For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of…

> On Android (by modifying the OS) I’m genuinely curious how you can imagine this is a realistic solution.

Developers could create a third party ROM with the privacy enhancements which users could install.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#73
post #52

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy. Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly. For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of…

Apple’s approach improves privacy in most contexts for all of its users, enough to shape market practices. Your approach works for a tiny, tiny sliver of people - which, by the nature of population-level snooping and marketing, are irrelevant.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#74
post #19
post #8

Earlier quoted context omitted.

The problem is that iOS doesn't differentiate between a call that merely checks for the presence of a clipboard entry (e.g. so you can enable "Paste" in a menu/submenu) and actually copying the contents of the clipboard. The workaround (for legitimate apps) is to simply always keep that "Paste" option enabled--even if the clipboard is empty. That way you won't freak out your users and only suffer the most minor of us…

iOS differentiates between this since iOS 10: https://developer.apple.com/documentation/uikit/uipasteboard... Also iOS 14 has new clipboard related APIs to further check the content without actually accessing it.

If iOS 14 adds new APIs to check, then I wouldn't be surprised if the codepath hasStrings uses triggers the warning

The purpose of hasStrings was performance not indicating intent, so that wouldn't be surprising

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#75
post #63

Here is an explanation from a 3rd party reddit app developer: tl;dr: Since Apple doesn't give a way to open URLs in 3rd party apps, he inspects the paste buffer for reddit URLs, but he aptly points out that he could read anything in the paste buffer if he wanted to: "Hey! I make Apollo for Reddit and a few people asked me about this and if Apollo does anything with the clipboard so I wanted to answer. Since iOS doesn…

We need an answer from TikTok not Apollo.

Of course. The point is there are legit reasons for this to happen.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#76
post #65
post #58

Earlier quoted context omitted.

Homebrew software and hacks aren't feasible solutions for the general population. You can't expect a tech-illiterate person to put up with all of that to protect their right to privacy. Like it or not, solutions like Apples' are much more efficient at protecting 1 billion (exaggeration) people at once.

I'm not even sure how something like T2 could be done with an open platform

Let the user replace the manufacturer's keys with their own?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#77

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#78

Perhaps there should be a separate security level for “access whatever was just Copied in the last 4 seconds, if the only other action taken was to switch to the app requesting the clipboard”. Almost any app could clear that bar, since under those conditions it probably means “user grabbed something and wants to use it here”. What is the use case for “read whatever was copied from anywhere for any reason at any time”…

That's probably not going to work well because people use devices at different speeds

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#79
post #72
post #59

Earlier quoted context omitted.

> On Android (by modifying the OS) I’m genuinely curious how you can imagine this is a realistic solution.

Developers could create a third party ROM with the privacy enhancements which users could install.

How is users having to trust third-party developers about privacy features in a ROM different to users having to trust Apple?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#80

iOS already prompts for other things like "app Foo would like to know your location: Never, Only when open, Always". Users are use to this. I'd love a popup like: "TikTok wants to see what you've copied into your clipboard: Never, Once, Always, Uninstall that spyware". Then I could make informed decisions, like sure, my package tracker can see if there's a FedEx URL in my clipboard. I'm OK with that. There's literall…

It’s unbelievable that Apple would leave this security hole wide open for so long. Notifying the user is not enough.
Post reply on HN