Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

361–370 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#361

Post by masklinn »

ogre_codes wrote: post #338
llacb47 wrote: post #158

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this: https://github.com/llacb47/mischosts/blob/master/tiktok-host...

> Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Maybe you just didn't copy anything TikTok was interested in keeping track of. I can think of a lot of really obnoxious things you can do with clipboard data, everything from scanning the contents to collect interests, scanning for URLs, collecting information about what applications are installed. A lot of this could be an…

> Maybe you just didn't copy anything TikTok was interested in keeping track of.

Odds are, like almost every other application it cares about website URLs to deep-link. Pretty much every reddit client does that for instance.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#362

Post by pjmlp »

p1necone wrote: post #212
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.

Yes it is, because devs aren't going to respect it.

Even Android is going into this direction, locking down APIs, access to Linux syscalls (not even considered part of NDK official APIs), background execution modes and file access.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#363

Post by pjmlp »

chipotle_coyote wrote: post #333
LordDragonfang wrote: post #295

Earlier quoted context omitted.

>they could convince non-technical users to switch to an unofficial app-store They could , but they're absolutely not going to. Every barrier you put between and user and installing your app is a percentage of those installs that you're losing. Doubly so for "non technical" users, who can barely work the app store in the first place. No company of that size is going to lose that many downloads just to steal a few mor…

This has been my feeling for years, and why I think it'd probably be in Apple's interest to let people sideload apps. They could still require them to be signed, but otherwise be hands-off. The vast majority of users wouldn't go through whatever hoops were necessary to set that up -- even if it's just the single hoop of flipping an "allow non-App Store apps" switch in Settings -- but making it possible to do that get…

So that iOS developers can enjoy the rampant piracy and app repackaging that takes place on Android?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#364

Post by masklinn »

_bxg1 wrote: post #29
harpastum wrote: post #15

It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification. If TikTok is actually constantly loading the clipboard, that's obviously terrible…

> There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button) People keep saying this but I've never seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing every app to be reading my clipboard at all times . It's inexcusable to me that there isn't a permissions prompt for this. Two…

> People keep saying this but I've never seen one of these app-specific paste widgets.

Both pocket and instapaper will prompt if open with a link in your clipboard.

Several reddit clients as well, I’ve seen in on narwhal and the Apollo dev explicitly noted they do that in the corresponding Reddit thread.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#365

Post by hanspeter »

ogre_codes wrote: post #341

I'm certain Apple knew in advance that a fair number of apps would trip this up and which ones were going to run into issues in advance. It's interesting that they went ahead and turned this on immediately without warning developers it was coming. Perhaps they wanted people to see what they were preventing.

> what they were preventing.

You could also look at it as _what they had offered apps unlimited access to in the previous 13 OS versions_.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#366

Post by jshen »

DaiPlusPlus wrote: post #216
p1necone wrote: post #212

Earlier quoted context omitted.

Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies]( https://blog.codinghorror.com/the-dancing-bunnies-problem/ ). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loadin…

I don’t think this is the case. The way iOS tells users that an app is tracking location in the background has led to a large increase in users opting out in all the apps I’ve worked on. There are ways to be very effective at this as Apple has shown since that article was written over 15 years ago.

Second, this effectiveness doesn’t require the walled garden and forcing apps to pay 30% of revenue to Apple.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#367

Post by jamaicahest »

greggman3 wrote: post #328
013a wrote: post #238

Earlier quoted context omitted.

A high speed collision happens on a freeway, killing both drivers. This is a car manufacturer bug, not a human bug. You can't expect millions of drivers to get driving right. A car should not be allowed to drive fast. How about: stop apologizing for billion dollar corporations. Fault can be placed on both the OS and applications. I expect better, from everyone.

The difference is one problem is trivially solvable. If an app isn't allowed to read the clipboard the problem is solved. Smart people choose solutions that actually solve the issue when those solutions exist rather than just making some guideline and praying people read it.

Companies developing apps should be held accountable for their decisions, i.e. spying on the clipboard in this case. Don't excuse them with the reason "well it was easy to do, so it's ok" that's like saying "well my car was stolen, but it was easy to break the lock so it's ok"

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#368

Post by cageface »

mrgreenfur wrote: post #197
andrepd wrote: post #178

Earlier quoted context omitted.

As opposed to apple which isn't because... apple says so.

No, because Apple makes money on subscriptions and retail purchases not on aggregating and reselling the data for advertisers.

Google doesn't sell data, it sells targeted access to users based on that data. Let's be precise if we're going to discuss the practical privacy implications of both platforms.

Meanwhile if you use iCloud backups all your data is one subpoena away from law enforcement.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#370

Post by kalleboo »

spideymans wrote: post #348
greggman3 wrote: post #334

Earlier quoted context omitted.

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.

I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?

In Safari you get a browser-provided popup menu that just has "Paste" in it when you click on the Google Docs Paste button, it doesn't paste directly
Post reply on HN