Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

331–340 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#331

Post by jkaptur »

filleduchaos wrote: post #170
pedrovhb wrote: post #152

Earlier quoted context omitted.

What's a legitimate, non-nefarious reason for an app to do that?

The contents of your clipboard _can_ be directly related to the functionality of an app. For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?"). Whether or not the convenience is worth it…

It's worth noting that Pocket does check if your clipboard currently contains a URL and does show such a banner. I think it's a handy feature.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#332

Post by fouc »

PatrolX wrote: post #124

Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits…

I hope someone does this and reports the results

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#333

Post by chipotle_coyote »

LordDragonfang wrote: post #295
DaiPlusPlus wrote: post #229

Earlier quoted context omitted.

That’s not my point: I’m arguing that apps like TikTok and Facebook are big enough that they could convince non-technical users (who are either ignorant-of, or just don’t care about, app permissions and privacy) to switch to an unofficial app-store where they could list their app without it being denied approval by Apple or Google for unreasonable app permission prompts. ...but the fact that unofficial app-stores for…

>they could convince non-technical users to switch to an unofficial app-store They could , but they're absolutely not going to. Every barrier you put between and user and installing your app is a percentage of those installs that you're losing. Doubly so for "non technical" users, who can barely work the app store in the first place. No company of that size is going to lose that many downloads just to steal a few mor…

This has been my feeling for years, and why I think it'd probably be in Apple's interest to let people sideload apps. They could still require them to be signed, but otherwise be hands-off. The vast majority of users wouldn't go through whatever hoops were necessary to set that up -- even if it's just the single hoop of flipping an "allow non-App Store apps" switch in Settings -- but making it possible to do that gets them out of a lot of the regulatory imbroglio they've been heading toward. (I also can't help but feel it's necessary in the long run if they're serious about the iPad in particular being a general purpose computing device rather than an application console.)

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#334

Post by greggman3 »

dylan604 wrote: post #284
greggman3 wrote: post #222

Earlier quoted context omitted.

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo.

It used to be true but all that was fixed like 10 years ago.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#335

Post by thewebcount »

cactus2093 wrote: post #149
speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

This is exactly why I am happy to see Apple cracking down more. I will grant you that this could very much be "innocent", but it's still completely unacceptable to me as a user. And just about every PM or founder I've ever worked with seems to think like this - when given the choice between the straightforward, obvious way to do something, and some crazy, brittle, privacy-abusing hack that might improve conversion by…

Oh man, that's awesome! I wish they'd do the same thing for contacts. There are a bunch of messaging apps that "need" access to every contact in your phone. I have 1 friend using their service, I don't want to give them access to my other contacts. So I don't use that app. But if I could restrict them to only the one contact I care about, I'd probably use them.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#336

Post by FeepingCreature »

andrepd wrote: post #175
harikb wrote: post #155

Earlier quoted context omitted.

Even if one were to ignore Google’s data collection, any non-vanilla android installation would have been butchered by the vendor (Samsung, Motorola, etc) to the point any expectation of security (and in turn privacy) is lost to the least secure app pre-installed. I had ESFileExplorer installed on a Nexus 7 tablet I barely used. One day I start it to find the charging has switched to “smart charging” where this softw…

Lineage is a must on any phone I get. I reckon I haven't had a vendor distro on my phone since 2012

I didn't check properly before I bought a Moto G5... the only Lineage image there is crashes its sound server whenever you connect a Bluetooth headset. I'm trying to get the dev to share their build steps so I can look into what is happening there, but they're not responding :(

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#337

Post by ogre_codes »

statictype wrote: post #318
patrickyeon wrote: post #68

Earlier quoted context omitted.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

Well, the problem is we don't know why they are using it. That almost makes the notifications useless. Apple puts app developers through an annoying review process. It seems like the least they could do is check with the developer on why they want that access and see if its legit or not.

> Well, the problem is we don't know why they are using it. > > That almost makes the notifications useless.

If your app is checking the clipboard or my location on a frequent basis, it's your job as the developer to communicate to me why you are doing this.

If the notifications are frustrating, users will turn off the permissions or remove the application entirely. Crappy snooping applications are gone. Mission accomplished.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#338

Post by ogre_codes »

llacb47 wrote: post #158

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this: https://github.com/llacb47/mischosts/blob/master/tiktok-host...

> Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere.

Maybe you just didn't copy anything TikTok was interested in keeping track of. I can think of a lot of really obnoxious things you can do with clipboard data, everything from scanning the contents to collect interests, scanning for URLs, collecting information about what applications are installed. A lot of this could be analyzed on device and it would only update infrequently.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#339

Post by dheera »

RandomBacon wrote: post #81
dheera wrote: post #52

Earlier quoted context omitted.

I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy. Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly. For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of…

> I'm probably going to get downvoted to hell It's a self-fulfilling prophecy. Don't bring it up next time. Reverse psychology (in an attempt to not get downvotes) doesn't work here, it just pisses people off (and is against the rules to complain about), so you WILL receive downvotes for mentioning it.

It happens whether or not I say that actually. Every time I disagree with Apple I get downvoted to oblivion. There are just too many Apple fanboys here who believe Apple is the be-all end-all of everything privacy.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#340

Post by chipotle_coyote »

sidibe wrote: post #233
mrgreenfur wrote: post #197

Earlier quoted context omitted.

No, because Apple makes money on subscriptions and retail purchases not on aggregating and reselling the data for advertisers.

Apple also makes money by selling their users to Google to do all that nasty stuff.

No, they really don't.

Remember the fun we had making fun of Apple Maps? Why in the world would Apple have dropped Google as the back end for their original Maps program, right? Well, it was because back in 2011 or so, Google refused to give Apple access to true turn-by-turn navigation features unless Apple gave them more access to user data. Rather than do that, Apple decided to go it themselves, even though that made the Maps product worse for years. This is consistent with Apple's behavior in other fields. (Hey, Siri!)

There are a lot of criticisms to be made of Apple, but "they're selling your data by proxy" just doesn't seem to be one of them.

Post reply on HN