Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

141–150 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#141

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes?

It’s disappointing to see the lack of skepticism applied on a site like Hacker News.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#142
post #97

I was shocked to find out that firefox enabled websites to access the clipboard sometime in the last five years or so. .. and I'm left stressed out that I could have had important passwords or key stolen this way. This can be disabled by setting a preference: https://www.ghacks.net/2014/01/08/block-websites-reading-mod...

Firefox prompts for your permission to read from the clipboard: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... But I'm not sure if that's always been the case.

that's for addons, not websites

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#143
post #48

It does make me wonder how many apps on Android also do this and go completely undetected. Hopefully Google adds something similar.

In my Android 10 phone, if I copy a piece of text that looks like an address and open Google Maps, Google Maps will immediately offer the copied text as a search option. Google Maps doesn't do this if I copied, say, some random numbers.

I'm not sure how the Google Maps app can do this without snooping at my clipboard.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#144

Earlier quoted context omitted.

Not being an Android user, one of the negatives that was often talked about (maybe no longer true?) is that a lot of phones could not upgrade to new versions of Android. Is that still a thing, or was that limited to the lower tier phones?

Lol you realize this used to be true of iOS too? I know after a few years my 3GS definitely wouldn't be able to handle the next iOS version.

The iPhone 3GS was released in June 2009, and the first iOS release that didn't support it was iOS 7 in September 2013.

4 years is much better than current Android phones, though it's true it doesn't quite live up to the current Apple lineup where iOS 14 is going to support the 6S which will be 5 years old by the time it launches.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#145

Whats the point of having an App Store as the gatekeeper for installing apps if you aren’t going to catch this shit?

I believe iOS14 has features to detect this: https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches...

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#147

Earlier quoted context omitted.

Because you would need to write and/or audit your entire technology toolchain — software, build tools, operating systems, hardware, etc — which isn't feasible for anyone.

not a single person, but the sum of all people looking at the different parts. that's how open source works.

I mean, I've known a few developers that worked at apple. I trust them every bit as much as the average developer who reads open source code. They vouched that the code they worked with at apple was attempting to be secure and wasn't trying to steal user's data.

If I'm not going to read the source code myself either way, why should I trust that random open source code-reader X who says "yup, didn't see any malicious code" vs a developer friend who works for apple and says "yup, no malicious code"?

Honestly, more often than not there's a lot of overlap between those people... And I'd bet that there's a ton of eyes I'd trust on iOS's source code given how many devs apple pays to work on it, while I think there's far fewer on most non-corporate open source projects.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#148
post #119

Earlier quoted context omitted.

It's definitely still a thing, as android updates are normally pushed by the manufacturers. The Android One phones are an exception to this.

Updates are still pushed by the manufacturer. I have the Xiaomi Mi A2 Lite (with Android One) and only got Android 10 last week. Biggest advantage is that it's a pure Android with no bloatware from the manufacturer. Also you get a guarantee IIRC to have at least two versions upgrades for the phone (my Xiaomi came with Android 8, so 10 should be the last one), and most of all security updates.

I mean, the fact that you need to say “pure android” kinda says it all, though.

All iOS is pure iOS. That’s the selling point for me, at least.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#149

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

This is exactly why I am happy to see Apple cracking down more. I will grant you that this could very much be "innocent", but it's still completely unacceptable to me as a user.

And just about every PM or founder I've ever worked with seems to think like this - when given the choice between the straightforward, obvious way to do something, and some crazy, brittle, privacy-abusing hack that might improve conversion by 5%, they'll choose the latter every time. This is a perfect example of this kind of thing, "let's just check the contents of the clipboard every 2 seconds in case the user doesn't know how to paste." It might have even been born out of real complaints from a fraction of users who really can't figure out how to paste. And somewhat depressingly, in the defense of PMs it does actually seem to work sometimes and improve conversions. And all your competitors are probably doing it already anyway. So the only way to stop this crap is for the platform itself to step in.

Another example that's also fixed in iOS 14 - Apple already provides a perfectly usable share sheet for choosing a photo, where I can look through my whole phone and pick just a single photo to give to the app. But for some crazy reason, seemingly every app wants to recreate this themselves. So they require you to give them access to your entire photo album so that they can display it back to you with a marginally different design and a different color background than the default page. Now in iOS 14, Apple is giving the user an option to just pick individual photos to share anyway, and then presumably make it appear to the app that those are all the photos you have on your phone.

Two very welcome improvements IMO.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#150
In the coming days I feel as if we are going to see a lot more threads about the new privacy features in iOS 14. Apple has a video overview of a lot of the new stuff [1]. I suggest watching it (at 2x speed - they talk very slowly). Especially at 16:30 where they emphasize that SDKs are part of your app and that you the developer are fully responsible for the data collection of any SDK you include in your app. This is going to be a huge problem for a lot of developers.

[1] https://developer.apple.com/videos/play/wwdc2020/10676/

Post reply on HN