Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

251–260 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#251

Post by Wingy »

np_tedious wrote: post #234
greggman3 wrote: post #222

Earlier quoted context omitted.

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too

Also, Apollo for Reddit prompts to open a link if you have a reddit link on your clipboard.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#252

Post by takeda »

andrepd wrote: post #175
harikb wrote: post #155

Earlier quoted context omitted.

Even if one were to ignore Google’s data collection, any non-vanilla android installation would have been butchered by the vendor (Samsung, Motorola, etc) to the point any expectation of security (and in turn privacy) is lost to the least secure app pre-installed. I had ESFileExplorer installed on a Nexus 7 tablet I barely used. One day I start it to find the charging has switched to “smart charging” where this softw…

Lineage is a must on any phone I get. I reckon I haven't had a vendor distro on my phone since 2012

Kind of unrelated, but what phones do you use? Also, can you still use Google apps?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#253

Post by scottoreily »

p1necone wrote: post #212
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.

And yet no one else has

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#254

Post by just-ok »

mrtksn wrote: post #117
SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

>It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo Okay, this could be simply a dynamic link library checking for a deep link in the clipboard. Why do this? To preserve the state after install. Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the ap…

That's all well and good, but as a privacy-conscious user I still want to (a) know about it and (b) be able to control/disable it.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#255

Post by voltagex_ »

takeda wrote: post #252
andrepd wrote: post #175

Earlier quoted context omitted.

Lineage is a must on any phone I get. I reckon I haven't had a vendor distro on my phone since 2012

Kind of unrelated, but what phones do you use? Also, can you still use Google apps?

You can still use Google Apps, but they must be sideloaded as part of the installation process before you boot LineageOS the first time.

I haven't found a LineageOS device that will pass the SafetyNet checks yet, though.

Is LineageOS still signed with testing keys?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#256

Post by voltagex_ »

bchanudet wrote: post #127
tedivm wrote: post #119

Earlier quoted context omitted.

It's definitely still a thing, as android updates are normally pushed by the manufacturers. The Android One phones are an exception to this.

Updates are still pushed by the manufacturer. I have the Xiaomi Mi A2 Lite (with Android One) and only got Android 10 last week. Biggest advantage is that it's a pure Android with no bloatware from the manufacturer. Also you get a guarantee IIRC to have at least two versions upgrades for the phone (my Xiaomi came with Android 8, so 10 should be the last one), and most of all security updates.

Fun. My Xiaomi came with ads baked into the app installer and a very questionable use of tracking in the web browser. Yes, Android One is great but not every device is in that program.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#257

Post by avianlyric »

jedieaston wrote: post #56
SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

1Password grabs the clipboard whenever I open the app, whether or not I'm even in a text field. Can't think of why it needs to do that..

The app does a check for URLs and will offer to open the URL using its own browser if it detects one.

Reading around it looks like there are better APIs for doing this, where you can ask iOS is the clipboard contains a string matching a pattern, which actually getting access to the content.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#258

Post by coronadisaster »

PatrolX wrote: post #124

Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits…

I did that many years ago but with email... I sent a secret link from and to a microft email address and it was then accessed by a microsoft bot...

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#259

Post by avianlyric »

filleduchaos wrote: post #170
pedrovhb wrote: post #152

Earlier quoted context omitted.

What's a legitimate, non-nefarious reason for an app to do that?

The contents of your clipboard _can_ be directly related to the functionality of an app. For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?"). Whether or not the convenience is worth it…

There a APIs in iOS (which existed before iOS 14) that allow you ask the OS if the clipboard content matches a pattern (e.g. is it a URL) that doesn’t trigger the warning in iOS 14.

It does appear that lots of apps don’t use these APIs, the developers probably never knew the existed till now, but there is a privacy preserving method of the building the functionality you talk of.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#260

Post by zlsa »

nmstoker wrote: post #192
platinumrad wrote: post #179

Earlier quoted context omitted.

Android blocked background clipboard access in 2019.

Here's a source confirming that: https://www.androidpolice.com/2019/03/14/android-q-will-kill...

It's worth noting that (AFAIK) iOS has never allowed apps in the background to read the clipboard buffer: https://security.stackexchange.com/a/176375
Post reply on HN