iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes • Hacker News Board

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#261

Post by GuB-42 » Thu, Jun 25, 2020, 2:25 AM UTC

patrickyeon wrote: post #68

speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

Why shouldn't apps use the API they are provided with?

It wasn't offensive to the user before iOS changed the rules. It is just a technical detail behind a small feature.

Every app can do bad things. For example, every app with a password field can use that data to crack your account on others services. You shouldn't reuse passwords but we all know that too few people follow that rule.

If you installed an app from some company, it means that you trust it to some extent and with that in mind it is reasonable to think that the issue is innocious. If you think a company wants to steal your passwords, why did you install its app in the first place? Clipboard or not, it will find a way of doing bad things.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#262

Post by madeofpalk » Thu, Jun 25, 2020, 2:27 AM UTC

SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

In that Reddit thread the author of a Reddit app mentions that they look at the clipboard to see if you have a Reddit link, and offer to open that page in the app (as iOS offers no better way).

On Twitter I saw a. Doing app mention they trigger the notification on every key press because they have custom ‘paste’ button that only shows when you have something copied.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#263

Post by skim_milk » Thu, Jun 25, 2020, 2:28 AM UTC

coronadisaster wrote: post #258

PatrolX wrote: post #124

Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits…

I did that many years ago but with email... I sent a secret link from and to a microft email address and it was then accessed by a microsoft bot...

Of course, they inspect received/sent email for spam/antivirus purposes

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#264

Post by madeofpalk » Thu, Jun 25, 2020, 2:29 AM UTC

pedrovhb wrote: post #152

trangon wrote: post #141

Earlier quoted context omitted.

How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes? It’s disappointing to see the lack of skepticism applied on a site like Hacker News.

What's a legitimate, non-nefarious reason for an app to do that?

There was an example on Twitter of a coding app offering a custom "paste" button that’s only enabled if they have something on the clipboard.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#265

Post by madeofpalk » Thu, Jun 25, 2020, 2:30 AM UTC

mrtksn wrote: post #117

SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

>It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo Okay, this could be simply a dynamic link library checking for a deep link in the clipboard. Why do this? To preserve the state after install. Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the ap…

Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#266

Post by kinkrtyavimoodh » Thu, Jun 25, 2020, 2:31 AM UTC

filleduchaos wrote: post #219

xvector wrote: post #189

Earlier quoted context omitted.

Other OSes aren't tooting the privacy horn from the top of a mountain.

So you're okay with "massive security holes" as long as their creators aren't "tooting the privacy horn"? Interesting indeed.

Yes, because a 'security hole' isn't a term defined a God. What security holes are holes or not is entirely a matter of user expectation.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#267

Post by Me1000 » Thu, Jun 25, 2020, 2:33 AM UTC

greggman3 wrote: post #222

xvector wrote: post #185

Earlier quoted context omitted.

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these ho…

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

Funny enough, Safari just opened up clipboard access via the async clipboard API: https://webkit.org/blog/10855/async-clipboard-api/

It does require a user initiated event to work, but then you can access the user's clipboard with:

`await navigator.clipboard.read();`

There are some additional restrictions though (you can read them in the first link) which it might make sense for iOS as a whole to adopt.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#268

Post by jquery » Thu, Jun 25, 2020, 2:34 AM UTC

mrep wrote: post #242

mrgreenfur wrote: post #197

Earlier quoted context omitted.

No, because Apple makes money on subscriptions and retail purchases not on aggregating and reselling the data for advertisers.

Apple took a 9 Billion dollar payment from Google in 2018 for Google to be the default search engine [0]. [0]: https://dazeinfo.com/2018/10/01/apple-google-fee-iphone-sear...

This doesn’t refute the parent.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#269

Post by xbar » Thu, Jun 25, 2020, 2:36 AM UTC

filleduchaos wrote: post #174

product50 wrote: post #154

This is the problem with Chinese apps. You just can't rely on them. They simply don't have the same principles of privacy like US companies do. Even Facebook won't do something like this.

Plenty of US companies build apps that do the exact same thing (checking your clipboard).

Do you like TikTok reading your clipboard?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#270

Post by filleduchaos » Thu, Jun 25, 2020, 2:38 AM UTC

avianlyric wrote: post #259

filleduchaos wrote: post #170

Earlier quoted context omitted.

The contents of your clipboard _can_ be directly related to the functionality of an app. For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?"). Whether or not the convenience is worth it…

There a APIs in iOS (which existed before iOS 14) that allow you ask the OS if the clipboard content matches a pattern (e.g. is it a URL) that doesn’t trigger the warning in iOS 14. It does appear that lots of apps don’t use these APIs, the developers probably never knew the existed till now, but there is a privacy preserving method of the building the functionality you talk of.

True (and I'm aware of those APIs). Just pointing out that "I want to know what's on the system clipboard without the user explicitly pasting" does not automatically equal trying to hoover up your data and phone home with it.