Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

221–230 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#221

Post by rootusrootus »

realusername wrote: post #200
BowBun wrote: post #58

Earlier quoted context omitted.

Homebrew software and hacks aren't feasible solutions for the general population. You can't expect a tech-illiterate person to put up with all of that to protect their right to privacy. Like it or not, solutions like Apples' are much more efficient at protecting 1 billion (exaggeration) people at once.

That's like saying that freedom of speech should be banned because most people have nothing to say. User rights needs to be there for the people who need it. The iPhone is currently a black box where it's very hard to know what is happening in it, that's a big issue in terms of privacy and accountability of the platform, not to mention the anti-competitive behaviours.

Is there a practical solution that isn’t a black box? For the general population, not enthusiasts.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#222

Post by greggman3 »

xvector wrote: post #185
PatrolX wrote: post #124

Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits…

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these ho…

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#223

Post by CGamesPlay »

patrickyeon wrote: post #68
speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

>will you lose out by only checking the clipboard when the user hits your text input field? Is it that much to ask that you find the least offensive way to serve your user?

In your toy example of my app's main screen being a text box where the user can insert a tracking code, yes, I do lose by making the user wonder every time "you know I have a tracking code why are you making me type it in?" In a more realistic example of, say, Amazon, where the "track my previous order" button is not the main screen of the app, the convenience is further increased by doing the detection automatically.

And what about non-text clipboard contents? Not every interface is a text-style document into which content can be embedded. Even "Copy URL" requires knowing that "share website" shared a URL and not a website. It doesn't make sense for images at all.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#224

Post by scarlac »

jasonlingx wrote: post #202

I use Bitwarden on my iPhone and sometimes copy passwords to the clipboard for some reason. Does this mean any app could have snooped on it without me knowing before?

Yes, that's probably part of the reason why 1Password clears the clipboard after a minute or so

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#225

Post by rootusrootus »

lwhi wrote: post #98
TheOtherHobbes wrote: post #79

Earlier quoted context omitted.

How is users having to trust third-party developers about privacy features in a ROM different to users having to trust Apple?

Android is open source, iOS is not.

The Android almost everyone uses is not open source.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#226

Post by dkonofalski »

the_gipsy wrote: post #104
kingnight wrote: post #100

Earlier quoted context omitted.

Because you would need to write and/or audit your entire technology toolchain — software, build tools, operating systems, hardware, etc — which isn't feasible for anyone.

not a single person, but the sum of all people looking at the different parts. that's how open source works.

Sure, but then you're putting your trust in those people. The point was that an individual can't possibly have the time or resources to do it themselves and so, at some point, they have to put their trust in someone else.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#227

Post by greggman3 »

patrickyeon wrote: post #68
speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

This is a OS bug not an app bug. You can't expect millions of app developers to get this right. An app should not be allowed to read the clipboard until a user chooses to "paste". That's on the OS for allowing this behavior. It's silly to think that making it possible to read the clipboard at any time that some how all millions of app developers will use it correctly even if they have no malicious intent.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#228

Post by cwhiz »

andrepd wrote: post #178
cwhiz wrote: post #122

Earlier quoted context omitted.

Android is a spyware operating system filled with first party spyware apps developed by Google.

As opposed to apple which isn't because... apple says so.

Align the incentives.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#229

Post by DaiPlusPlus »

p1necone wrote: post #220
DaiPlusPlus wrote: post #216

Earlier quoted context omitted.

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies]( https://blog.codinghorror.com/the-dancing-bunnies-problem/ ). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loadin…

At least in Android (not familiar with iOS) you can deny apps access to any and all permissions, the features just won't work. I.e. if you deny Snapchat access to the camera you can still browse the app, read messages etc - you just won't be able to take any photos.

That’s not my point: I’m arguing that apps like TikTok and Facebook are big enough that they could convince non-technical users (who are either ignorant-of, or just don’t care about, app permissions and privacy) to switch to an unofficial app-store where they could list their app without it being denied approval by Apple or Google for unreasonable app permission prompts.

...but the fact that unofficial app-stores for unjailbroken iOS devices do not exist makes this impossible for now.

It’s very easy to imagine a TV ad or movie trailer ad for a TikTok or Facebook app with the cheerfully-voiced narrator saying “Just visit the TikTok Android App Store” or “Just open the Facebook iOS App Store” - then when the app is installed and first-opened the app would use a single “grant everything” permission prompt - or if the OS doesn’t allow that it could bombard the user with many prompts all-at-once and if the user denies any of them then a curtly-worded new messagebox would say “you must grant these permissions to use our app” otherwise the app quits. There’s not much Apple or Google could do to stop this that those app developers couldn’t work-around. Apple’s iOS App Store rejections for privacy reasons is a human solution to a non-technical problem, as it’s well-established that technical solutions to non-technical problems are ineffectual.

It can be argued this is possible on Android - which does allow for other app-stores - and I did wonder why this isn’t already happening with Android users - then I realised that probably most Android users have those horrible carrier and OEM locked-down devices that make it harder (if not impossible) to change system settings or add other app-stores.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#230

Post by greggman3 »

jetpks wrote: post #210
greggman3 wrote: post #206

Earlier quoted context omitted.

The walled garden does no such thing. Either iOS is secure or it's not. if it's secure there is no need for the walled garden. Let me run anything and trust its security. If it's not secure then the walled garden is security theater because it's trivial for any app to hide its true intent.

> Either iOS is secure or it's not This is flat out wrong. Security isn't binary.

It's not wrong. Browsers don't have a walled garden. They just try to be secure period. Apple's fictions is their walled garden saves you from bad apps. It doesn't. There have been and will be plenty of bad apps. A secure platform saves you from bad apps, period.
Post reply on HN