Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

291–300 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#291

Post by whynaut »

Deflect wrote: post #211
Koshkin wrote: post #191

Earlier quoted context omitted.

A picture on a TV screen didn’t use to spy on you...

That's not exactly true. Assuming you didn't mean TVs completely without any internet connection whatsoever then you'll find that pretty much since that ability was added there have been attempts by the very manufacturers to do just that. Vizio isn't the only one but here's an example: https://www.tomsguide.com/amp/us/vizio-ftc-smart-tv-spying-p... How-to disable additional snooping: https://www.consumerreports.org/p…

> That's not exactly true. Assuming you didn't mean TVs completely without any internet connection whatsoever

It’s way too early for this to be a reasonable assumption. The fact that they made that comment implies they are aware how widespread the is.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#292

Post by bredren »

patrickyeon wrote: post #106
cbsmith wrote: post #94

Earlier quoted context omitted.

I'm not sure that looking at what a user is typing into the comment box for the application really qualifies as a significant privacy violation. That presumes a privacy model that isn't terribly intuitive or practical. Now, if they had evidence that the data from the keyboard was being sent up to a server, that'd be a different story.

In this case we're talking about apps monitoring the copy buffer when they aren't foregrounded. Your example of monitoring a comment box isn't what we're discussing. In the copy buffer example, I think a privacy model of "an app in the background can't read what I'm copy-pasting in other apps" seems very reasonable and fits my idea of what a "standard user" would expect. Personally, I would prefer a world where nothi…

I agree. I am very surprised Apple started with a notification. This absolutely should be permission based like location or anything else. There are zero cases where TikTok or facebook should need my clipboard.

A notification that they’ve already done it is not enough. It should tell you every time even if you approved it.

The only explanation I can come up with for why Apple isn’t making this opt in like location is it is so widespread it would break many apps. I just can’t understand how, or why they wouldn’t announce a transition-by date like with Sign in by Apple.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#293

Post by bredren »

patrickyeon wrote: post #106
cbsmith wrote: post #94

Earlier quoted context omitted.

I'm not sure that looking at what a user is typing into the comment box for the application really qualifies as a significant privacy violation. That presumes a privacy model that isn't terribly intuitive or practical. Now, if they had evidence that the data from the keyboard was being sent up to a server, that'd be a different story.

In this case we're talking about apps monitoring the copy buffer when they aren't foregrounded. Your example of monitoring a comment box isn't what we're discussing. In the copy buffer example, I think a privacy model of "an app in the background can't read what I'm copy-pasting in other apps" seems very reasonable and fits my idea of what a "standard user" would expect. Personally, I would prefer a world where nothi…

I agree. I am very surprised Apple started with a notification. This absolutely should be permission based like location or anything else. There are zero cases where TikTok or facebook should need my clipboard.

A notification that they’ve already done it is not enough. It should tell you every time even if you approved it.

The only explanation I can come up with for why Apple isn’t making this opt in like location is it is so widespread it would break many apps. I just can’t understand how, or why they wouldn’t announce a transition-by date like with Sign in with Apple.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#294

Post by efreak »

Polylactic_acid wrote: post #207
andrepd wrote: post #195

Earlier quoted context omitted.

You forgot option 3: use Lineage+microg and enjoy the most private and secure platform available on a smartphone today. But if you chose the first one then you can't, because apple won't let you choose the software that runs on the equipment you bought.

I used to use linageOS no gapps and I loved it but then my nexus 5x died and I got a pixel 2 and linageOS support stopped at the pixel 1. It seems to me that the age of custom roms is over. Android got good enough that the only reason for a custom rom was privacy and extended updates. Since the pixel 2 is still updated there is no reason other than privacy and I guess no one was willing to put in the work for just th…

> Since the pixel 2 is still updated there is no reason other than privacy

Features.

- The ability to run Android without Google. - The ability to change the location of your clock. - The ability to have some apps open with the status bar and navbar and some not. - The ability to change your WiFi network without opening settings (yes, I'm still upset they removed that. I use an Android 8 tablet daily, so I'm unlikely to forget). - Adding invisible left/right dpad buttons and a menu button in my navbar. - Change the number of quick settings. - Change the screen dpi (this is implemented these days, I think, but only with 3-5 settings available) - use adb without first plugging into a computer. Maybe I'm going somewhere and I'll need to restart my phone. - run Linux in a chroot (far better than proot) - install Fdroid privileged extension without losing access to security updates.

You can say full well that you don't care about these, you don't have to care. However, these are all things that you can't do without an alternative ROM (or without rooting, which loses access to updates).

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#295

Post by LordDragonfang »

DaiPlusPlus wrote: post #229
p1necone wrote: post #220

Earlier quoted context omitted.

At least in Android (not familiar with iOS) you can deny apps access to any and all permissions, the features just won't work. I.e. if you deny Snapchat access to the camera you can still browse the app, read messages etc - you just won't be able to take any photos.

That’s not my point: I’m arguing that apps like TikTok and Facebook are big enough that they could convince non-technical users (who are either ignorant-of, or just don’t care about, app permissions and privacy) to switch to an unofficial app-store where they could list their app without it being denied approval by Apple or Google for unreasonable app permission prompts. ...but the fact that unofficial app-stores for…

>they could convince non-technical users to switch to an unofficial app-store

They could, but they're absolutely not going to. Every barrier you put between and user and installing your app is a percentage of those installs that you're losing. Doubly so for "non technical" users, who can barely work the app store in the first place. No company of that size is going to lose that many downloads just to steal a few more downloads.

>then I realised that probably most Android users have those horrible carrier and OEM locked-down devices that make it harder (if not impossible) to change system settings or add other app-stores.

Stock android makes you jump through hoops to install third party apps, and for good reason. No, it's not because "OEM locked-down devices", the reason you don't see it on android is because it doesn't make business sense.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#296

Post by gitgud »

xvector wrote: post #182
llacb47 wrote: post #158

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this: https://github.com/llacb47/mischosts/blob/master/tiktok-host...

Genuine question, why don't companies proxy tracker data through a single host that the app also depends on to serve data? That way it wouldn't be possible for users to block individual hosts to prevent tracking. I guess it's not worth the effort though because laypeople won't care either way?

They aren't proxy'd because advertisers want to ensure they control the domain and can verify requests are going to it, without having to trust the content provider.

Some content providers don't allow you to view content if you block the advertising hosts.

Then it becomes a matter how you want to deal with failure, do you want the site to break if your ads don't load?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#298

Post by rimjongun »

dogecoinbase wrote: post #125
the_gipsy wrote: post #104

Earlier quoted context omitted.

not a single person, but the sum of all people looking at the different parts. that's how open source works.

The (ongoing) saga of libssh alone should be enough convincing that many eyes do nothing as regards shallowness.

I read in a news paper that one time this search party completely missed a young girl they were looking for. Your logic would dictate that search parties are a waste of time. Is open source a panacea? No, clearly, as you stated. Are more eyes, even untrained ones, better than no eyes? Ask all the people saved by search party volunteers every year.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#300

Post by rimjongun »

7786655 wrote: post #76
jdxcode wrote: post #65

Earlier quoted context omitted.

I'm not even sure how something like T2 could be done with an open platform

Let the user replace the manufacturer's keys with their own?

Imagine grandma accidentally putting her phone number in instead of an encryption key.
Post reply on HN