We can expect every security hole possible to be exploited by these Chinese military apps. Heck, Fortnite intalls a rootkit on your PC for "anti-cheat" and that's even more egregious, yet it is allowed. The situation on Android is probably worse, most apps request access to everything these days and users are afraid to say "no" because of fear of breakage.
iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
161–170 of 613 posts
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#162Earlier quoted context omitted.
How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes? It’s disappointing to see the lack of skepticism applied on a site like Hacker News.
What's a legitimate, non-nefarious reason for an app to do that?
The maker of the Apollo Reddit app chimed in on the reddit thread that his app would check to see if a reddit URL was in the clipboard and offer to take you to that page.
Chrome uses it so the URL appears when you select the address bar.
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#163Earlier quoted context omitted.
Especially when its taken 14 versions to get this information.
To be pedantic, version 1 and 2 of iPhone OS did not have a clipboard at all …
Was it called iPhone OS then? At some point I remember Apple saying it was basically OS X running on the phone. Weird how that went.
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#164Earlier quoted context omitted.
It's definitely still a thing, as android updates are normally pushed by the manufacturers. The Android One phones are an exception to this.
Updates are still pushed by the manufacturer. I have the Xiaomi Mi A2 Lite (with Android One) and only got Android 10 last week. Biggest advantage is that it's a pure Android with no bloatware from the manufacturer. Also you get a guarantee IIRC to have at least two versions upgrades for the phone (my Xiaomi came with Android 8, so 10 should be the last one), and most of all security updates.
Phones only getting 2 major software updates (which are released yearly, so 2 years) is a bit of a deal breaker for me. I understand older versions of Android are pretty well supported at least by apps in Google Play.
Also what bothers me about Android devices: I got a Galaxy S8 to do development for work, and not all manufacturers are created equal in updates of course; IIRC I waited almost a full year after the Google flagships to receive Android 9 — in fact I think I got Android 8 around the time Android 9 came out.
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#165Earlier quoted context omitted.
I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…
> Is it that much to ask that you find the least offensive way to serve your user? Up until now there’s been no way the user has been offended because they haven’t known it’s happening. So there’s no real incentive to do it when you focus on a text field vs anything else. And more broadly, there isn’t a downside if you use the API honestly: e.g. to check for a numeric code that matches whatever regex for one of your…
"The OS snitching on us and then annoying the user" is an interesting definition of "offensive", but definitely not the one I meant. Let me put it another way: if you put the appropriate amount of effort into asking "what's the robust, minimally invasive, least-likely to be misinterpreted and/or abused, way for me to accomplish this?" you are likely to create a better product and less likely to have something like this pop up.
So let's say you're making the tracking notifier, and you work for UPS. The regex is `1Z[0-9]{16}`. All good, you're being nice, someone opens your app and you already know what shipment they're interested in. Then a "growth hacker" joins your group and mentions that it'd be nice to know how many of your customers also use FedEx, so the regex is changed to also grab FedEx tracking numbers (`(1Z)?[0-9]{16}`, I think). And now someone gets the genius idea of checking up on package shipped by competitors and popping up a notification "tired of waiting on DHL? UPS delivers within 2 days 99.995% of the time" when they miss a delivery. Even though they never asked UPS abotu their DHL package.
See how that progresses? See how it's offensive, even if you're not annoying your user more than you normally would with spammy push notifications, and even before your user suspects that you're spying like this? Do you see how this whole series of escalations aren't available, or at least not as easy, if you only check the copy buffer when it's likely a user is about to paste? Instead of "tweak what we already have" you have to "include a new snooping routine".
If you're thinking "all is fair in love and war" here, and this seems like genius marketing: 1) this is your heads up that your morals are not in line with society's, and 2) do you think this will be a marketing win if the regex is loosened enough that you pop up a UPS notification about "package with tracking number (phone number someone just gave me)"? What about if my UPS account for work notifies me about some very private personal packages? Especially some shipped via OnTrak?
Anyway, as I said in my first comment. I'm disappointed that people don't think they should try to worry about downsides and failure modes of their design and engineering work. Maybe it's a matter of norms and priorities being different in the consumer app/web world vs. many other domains.
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#166Earlier quoted context omitted.
> There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button) People keep saying this but I've never seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing every app to be reading my clipboard at all times . It's inexcusable to me that there isn't a permissions prompt for this. Two…
> I've never seen one of these app-specific paste widgets IIRC having an address (or address-looking string) in your clipboard will cause it to show up as the first result on the search screen in Google Maps.
So google also sends the contents of my clipboard to their servers when I use their app? Wonderful.
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#167Earlier quoted context omitted.
Not being an Android user, one of the negatives that was often talked about (maybe no longer true?) is that a lot of phones could not upgrade to new versions of Android. Is that still a thing, or was that limited to the lower tier phones?
It is true that many vendors abandon their devices more quickly than I would like, but it depends on the vendor and the "flagshipness" of the device. Also, since version 8.0, Google has made a number of improvements to the modularity of the OS which make it easier for vendors to release updates ("Project Treble"), so the problem has been reduced somewhat
While fact checking my other comment here, it seems like Samsung has been slow to roll out major version upgrades _since_ Android 8. Have other manufacturers improved in this regard since Project Treble?
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#168It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification. If TikTok is actually constantly loading the clipboard, that's obviously terrible…
> There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button) People keep saying this but I've never seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing every app to be reading my clipboard at all times . It's inexcusable to me that there isn't a permissions prompt for this. Two…
I use this all the time with Pocket (copy a URL somewhere, then switch to Pocket, where it asks if I want to bookmark the just copied URL).
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#169Earlier quoted context omitted.
Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.
Even if one were to ignore Google’s data collection, any non-vanilla android installation would have been butchered by the vendor (Samsung, Motorola, etc) to the point any expectation of security (and in turn privacy) is lost to the least secure app pre-installed. I had ESFileExplorer installed on a Nexus 7 tablet I barely used. One day I start it to find the charging has switched to “smart charging” where this softw…
I often use Motorola devices as I find they are one of the OEMs which applies the fewest customizations to the OS. However Samsung is definitely a problem when it comes to that.
I am not sure what happened in your case with ES or how that would be possible. It sounds like maybe the app just pushed you an advertisement as a notification. Notifications can be disabled on a per-app basis but I think it is pretty reasonable that they are enabled by default.
Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes
#170Earlier quoted context omitted.
How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes? It’s disappointing to see the lack of skepticism applied on a site like Hacker News.
What's a legitimate, non-nefarious reason for an app to do that?
The contents of your clipboard _can_ be directly related to the functionality of an app.
For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?").
Whether or not the convenience is worth it might be debatable, but I fail to see how one would call that nefarious.