Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

111–120 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#111

Post by whynotminot »

the_gipsy wrote: post #104
kingnight wrote: post #100

Earlier quoted context omitted.

Because you would need to write and/or audit your entire technology toolchain — software, build tools, operating systems, hardware, etc — which isn't feasible for anyone.

not a single person, but the sum of all people looking at the different parts. that's how open source works.

I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true.

In theory it means something could maybe be safer, but it far from guarantees it.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#112

Post by untog »

jedieaston wrote: post #56
SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

1Password grabs the clipboard whenever I open the app, whether or not I'm even in a text field. Can't think of why it needs to do that..

It’s for two factor auth tokens. When I fill in a password it copies my two factor code to the clipboard, then ~30 seconds later it restores the original clipboard content.

All pretty silly all things considered but I can’t think of an easier way to do things.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#113

Post by gggmaster »

baddox wrote: post #107
the_gipsy wrote: post #104

Earlier quoted context omitted.

not a single person, but the sum of all people looking at the different parts. that's how open source works.

And thus you would need to trust those people.

Better than trusting a black box from a single business.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#114

Post by tedivm »

patrickyeon wrote: post #84
shawnz wrote: post #77

Earlier quoted context omitted.

Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.

I've only ever been an Android user, but for a while I was paying a lot of attention to iOS too. It seems to me like they've been back and forthing, as one side figures out some improvements, the other side more-or-less re-implements them on their next release with their own unrelated improvements. Seems like a good thing, really.

From my perspective it seems like Apple keeps releasing new privacy features and Android keeps being forced to catch up. What are the major privacy enhancements that Google has put out first?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#115

Post by untog »

patrickyeon wrote: post #68
speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

> Is it that much to ask that you find the least offensive way to serve your user?

Up until now there’s been no way the user has been offended because they haven’t known it’s happening. So there’s no real incentive to do it when you focus on a text field vs anything else.

And more broadly, there isn’t a downside if you use the API honestly: e.g. to check for a numeric code that matches whatever regex for one of your orders and otherwise disregard the data immediately. I’d bet a good number of users find it useful.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#116

Post by gggmaster »

whynotminot wrote: post #111
the_gipsy wrote: post #104

Earlier quoted context omitted.

not a single person, but the sum of all people looking at the different parts. that's how open source works.

I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could maybe be safer, but it far from guarantees it.

But for a closed source one there’s definitely no way to audit the source code.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#117

Post by mrtksn »

SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

>It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo

Okay, this could be simply a dynamic link library checking for a deep link in the clipboard.

Why do this? To preserve the state after install.

Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen.

The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session.

Of course, with iOS 14 the best practice would be to do this only once after the install.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#119

Post by tedivm »

dylan604 wrote: post #108
patrickyeon wrote: post #84

Earlier quoted context omitted.

I've only ever been an Android user, but for a while I was paying a lot of attention to iOS too. It seems to me like they've been back and forthing, as one side figures out some improvements, the other side more-or-less re-implements them on their next release with their own unrelated improvements. Seems like a good thing, really.

Not being an Android user, one of the negatives that was often talked about (maybe no longer true?) is that a lot of phones could not upgrade to new versions of Android. Is that still a thing, or was that limited to the lower tier phones?

It's definitely still a thing, as android updates are normally pushed by the manufacturers. The Android One phones are an exception to this.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#120

Post by pavel_lishin »

speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

> Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

If I find someone digging through my mailbox, I don't start rationalizing their reasons for it - I ask them to explain themselves, and that explanation had better fucking be a good one.

Post reply on HN