Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

281–290 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#281

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

The walled garden does no such thing. Either iOS is secure or it's not. if it's secure there is no need for the walled garden. Let me run anything and trust its security. If it's not secure then the walled garden is security theater because it's trivial for any app to hide its true intent.

“Either iOS is secure or it’s not” You must not be up on security, and that’s cool, we all have stuff to learn.

So let’s define our terms a little bit. What is our walled garden and what does it bring to the table in terms of security?

Off the top of my head I’m thinking we get more eyes during the review process, maybe some static/malware analysis, etc.. Another thing is the “soft controls”, not allowing certain classes of apps that Apple doesn’t feel “belong” in their garden. Well that’s a net security benefit too. Less apps, less possibility of exposure, more careful and selective choosing of apps allowed, you’re going to see less shady stuff and abuse.

Compare the two app stores, it’s not even close.

So the security benefits of a tight review/control process are pretty clear, and play out in the results of malware outbreaks between Google and Apples app stores.

The question of trading freedom for security is another topic, one that cuts deep into the fabric of western society. Too deep for this convo!

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#282
post #169
post #155

Earlier quoted context omitted.

Even if one were to ignore Google’s data collection, any non-vanilla android installation would have been butchered by the vendor (Samsung, Motorola, etc) to the point any expectation of security (and in turn privacy) is lost to the least secure app pre-installed. I had ESFileExplorer installed on a Nexus 7 tablet I barely used. One day I start it to find the charging has switched to “smart charging” where this softw…

I often use Motorola devices as I find they are one of the OEMs which applies the fewest customizations to the OS. However Samsung is definitely a problem when it comes to that. I am not sure what happened in your case with ES or how that would be possible. It sounds like maybe the app just pushed you an advertisement as a notification. Notifications can be disabled on a per-app basis but I think it is pretty reasona…

Apparently it is not new change [1]. I just happened to notice it now since I rarely used it before. Now the tablet functions as a handy Zoom whiteboard [2] drawing tablet. Good thing I didn't throw it out.

[1] https://www.androidpolice.com/2016/05/10/es-file-explorer-up...

[2] To those who might laugh at my paranoia about ES while I happily use Zoom, I teach classes and it is not an easy choice not to use Zoom.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#283

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

In that Reddit thread the author of a Reddit app mentions that they look at the clipboard to see if you have a Reddit link, and offer to open that page in the app (as iOS offers no better way). On Twitter I saw a. Doing app mention they trigger the notification on every key press because they have custom ‘paste’ button that only shows when you have something copied.

Yep, for Apollo app, it makes sense why he does it. But for other apps like TikTok, it makes no sense. I wonder if the app also sends the clipboard data after that. Someone should look into network requests being made.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#284

Earlier quoted context omitted.

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these ho…

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#285
post #280

Earlier quoted context omitted.

At least in Android (not familiar with iOS) you can deny apps access to any and all permissions, the features just won't work. I.e. if you deny Snapchat access to the camera you can still browse the app, read messages etc - you just won't be able to take any photos.

By and large this is true. However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. I don't think Apple would allow that kind of permissions abuse, but apparently Google does.

> However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront.

Considering Citi’s corporate culture, I’d attribute this to incompetence rather than malice or a desire to spy on users.

I’ll bet they’re using a third-party anti-spyware library to examine the Android FS for keyloggers/etc to protect their users’ security. It’s well-intentioned, but still idiotic.

This is the same Citibank that’s been engaged in an idiotic arms-race with Google about blocking password-safes on their online banking login page for the past 5+ years - while also allowing me to do phone-banking without any real authentication - and STILL haven’t given me an EMV Chip+PIN credit-card, while the EMV Chip+Sign card I do have from them DOES have NFC without a purchase limit... anyone could steal my wallet and “tap” a couple grand off it. Arggghhhhhh.

The “banks who think they’re smarter about security than platform vendors” trope is getting real old.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#286
post #210

Earlier quoted context omitted.

> Either iOS is secure or it's not This is flat out wrong. Security isn't binary.

It's not wrong. Browsers don't have a walled garden. They just try to be secure period. Apple's fictions is their walled garden saves you from bad apps. It doesn't. There have been and will be plenty of bad apps. A secure platform saves you from bad apps, period.

Again, you speak in this world of binary absolutes. Passionate, but clearly not an experienced security practitioner. “A secure platform saves you from bad apps, period”

How did you come to this statement? Because my initial reaction is not a flattering one for you, but hey, I’m learning too and I find this topic super interesting. Could you provide an example of a secure platform securing against threats in such an absolute way? Maybe QubesOS? I’d like to hear your reasoning a bit more.

Also, I want to touch on your statement of browsers not having walled gardens, and being secure in a general sense. Are you under the impression that modern browsers are equivalent to all other kinds of apps in regards to their threat profile? Also, are you aware that most modern browsers phone home URLs to check against a malicious site list? I look at this as “walled-garden lite”

Personally, I keep flip flopping between MacOS, Windows 10 with WSL2 + Fedora, and a 8GB RPI 4B, which for the last few days has been doing ok for a desktop.

My point? The security vs freedom debate is complicated, and for many, rages back and fourth even in the same person. There are very few absolutes in this world. Save your hills to die on for points you KNOW you’re right about, because in this, you’re waaaaaaay off base.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#287

Earlier quoted context omitted.

As opposed to apple which isn't because... apple says so.

No, because Apple makes money on subscriptions and retail purchases not on aggregating and reselling the data for advertisers.

China :)

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#288

Earlier quoted context omitted.

As opposed to apple which isn't because... apple says so.

No, because Apple makes money on subscriptions and retail purchases not on aggregating and reselling the data for advertisers.

iOS 14 also makes app ad tracking opt-in, Google would never.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#289
post #155

Earlier quoted context omitted.

Even if one were to ignore Google’s data collection, any non-vanilla android installation would have been butchered by the vendor (Samsung, Motorola, etc) to the point any expectation of security (and in turn privacy) is lost to the least secure app pre-installed. I had ESFileExplorer installed on a Nexus 7 tablet I barely used. One day I start it to find the charging has switched to “smart charging” where this softw…

Lineage is a must on any phone I get. I reckon I haven't had a vendor distro on my phone since 2012

I was running Lineage on the tablet and I am usually very careful about what I allow. I have no idea how it got set to take over main screen at charging time.

Btw, all these distributions (Lineage and Cynogenmod before that) don't benefit from automated updates. So that is another headache to remember to manually reflash/upgrade.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#290

Earlier quoted context omitted.

I mean, the fact that you need to say “pure android” kinda says it all, though. All iOS is pure iOS. That’s the selling point for me, at least.

So if you can choose between pure and not pure, locked vs unlocked, is worse? Interesting selling point

For some of us, having a locked down, reliable, secure, and pure phone is a great solution.

I don’t want iOS on my random experimental project laptop, for that I have Linux or windows, or vms. But, cellphones are not something I need to hack around on.

Post reply on HN