Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

151–160 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#151

Post by odensc »

gentleman11 wrote: post #2

I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin. I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

On Chrome at least, Bitwarden has it's own extension popup window with the vault. This is a completely separate web context. There's no way for the open website to detect your keystrokes barring a vulnerability in Chrome itself.

If you really want to be safe, you should use the standalone desktop apps and skip the browser extension altogether. Doing that empty tab thing probably doesn't protect you from anything.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#152

Post by pedrovhb »

trangon wrote: post #141
SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes? It’s disappointing to see the lack of skepticism applied on a site like Hacker News.

What's a legitimate, non-nefarious reason for an app to do that?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#153

Post by ladberg »

pininja wrote: post #39
riskable wrote: post #8

Earlier quoted context omitted.

The problem is that iOS doesn't differentiate between a call that merely checks for the presence of a clipboard entry (e.g. so you can enable "Paste" in a menu/submenu) and actually copying the contents of the clipboard. The workaround (for legitimate apps) is to simply always keep that "Paste" option enabled--even if the clipboard is empty. That way you won't freak out your users and only suffer the most minor of us…

> I don't think TikTok has any relevant functionality Does pasting text into a video as an annotation require “Paste” to be enabled in this way?

I believe any time you paste with the native keyboard UI up it doesn't go through the app. You only need to snoop the clipboard if you want to proactively use the data without having the user paste.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#155

Post by harikb »

shawnz wrote: post #77
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.

Even if one were to ignore Google’s data collection, any non-vanilla android installation would have been butchered by the vendor (Samsung, Motorola, etc) to the point any expectation of security (and in turn privacy) is lost to the least secure app pre-installed.

I had ESFileExplorer installed on a Nexus 7 tablet I barely used. One day I start it to find the charging has switched to “smart charging” where this software shows a banner ad on the home/charging screen. There is no end to the madness of what each app can do or even allowed to ask for.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#156

Post by gruez »

nullc wrote: post #97

I was shocked to find out that firefox enabled websites to access the clipboard sometime in the last five years or so. .. and I'm left stressed out that I could have had important passwords or key stolen this way. This can be disabled by setting a preference: https://www.ghacks.net/2014/01/08/block-websites-reading-mod...

I don't think that site's accurate. I searched around and there seems to be two ways of reading clipboard contents: making a fake dom element and waiting for the user to paste, or to use the async clipboard api. The first doesn't seem abusable because it requires you to actually paste something. The second doesn't seem to be supported by firefox, at least according to this demo: https://googlechrome.github.io/samples/async-clipboard/.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#157

Post by odensc »

nmaggioni wrote: post #70
gentleman11 wrote: post #2

I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin. I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

I had the same exact concern, and I haven't been able to find reliable confirmations on this being completely impossible either. It's easily testable, though, that a webpage that isn't focused (because an extension's pane is open) doesn't receive input events. Likewise, Chrome [1] and Firefox [2] extensions themselves cannot bind to relevant keys for example. All in all I would say that going through an empty tab is…

Well, you probably couldn't find any confirmation because nothing in the security world is completely impossible :) Webpages aren't supposed to be able to receive input events when the extension popup is open, but there could still be an unknown vulnerability in Chrome/Firefox.

So if you care enough it's best to mitigate that risk by using the standalone application for your password manager, or better yet use a completely separate device like your phone!

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#158

Post by llacb47 »

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere.

Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this:

https://github.com/llacb47/mischosts/blob/master/tiktok-host...

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#159

Post by fiddlerwoaroof »

gggmaster wrote: post #116
whynotminot wrote: post #111

Earlier quoted context omitted.

I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could maybe be safer, but it far from guarantees it.

But for a closed source one there’s definitely no way to audit the source code.

Sure there is: tools like strace, dtrace and eBPF let you “peak under the hood” of nearly any application, not to mention disassemblers like IDA Pro and Ghidra.

I have debugged all sorts of issues with closed source applications using these tools.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#160

Post by mrtksn »

pedrovhb wrote: post #152
trangon wrote: post #141

Earlier quoted context omitted.

How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes? It’s disappointing to see the lack of skepticism applied on a site like Hacker News.

What's a legitimate, non-nefarious reason for an app to do that?

Session restoration after install. Explained here: https://news.ycombinator.com/item?id=23635223
Post reply on HN