Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

371–380 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#371

Post by BiteCode_dev »

SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

"Companies just cannot be trusted with x" has been repeated and repeated for the last decades.

I think the conclusion is "Companies just cannot be trusted". At all. With anything.

We should assume guilty unless proven overthise for companies. They should go out of their way to show us their good will.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#372

Post by abc-xyz »

dzhiurgis wrote: post #329
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

How is that Apple didn't catch TikTok doing this way way earlier to give them some sort of penalty.

Maybe the Chinese government forced Apple the same way that they’re forcing them to secretly share [Chinese] users [in China] most sensitive data with the government (photos, videos, notes and everything automatically backed up by iCloud).

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#373

Post by AnonC »

p1necone wrote: post #220
DaiPlusPlus wrote: post #216

Earlier quoted context omitted.

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies]( https://blog.codinghorror.com/the-dancing-bunnies-problem/ ). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loadin…

At least in Android (not familiar with iOS) you can deny apps access to any and all permissions, the features just won't work. I.e. if you deny Snapchat access to the camera you can still browse the app, read messages etc - you just won't be able to take any photos.

That model was pioneered by Apple in iOS long before Android started taking it up with Android 6 (runtime permissions instead of collective install time permissions). Android took a few years to catch up and increase the range of runtime permissions, and apps on Android at that time would actually crash if some permission wasn't given.

Even today, there are apps on Android that ask for needless permissions and refuse to continue unless the permissions or granted. That same app on iOS would provide more functionality (that's possible without having the permissions). There seems to be a very different mindset between Android developers compared to iOS developers.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#374

Post by j45 »

shawnz wrote: post #77
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.

I carry an Android. In Android, you and your data is the product, nothing else.

In Apple the phone is the product.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#375

Post by just-ok »

BoorishBears wrote: post #319
madeofpalk wrote: post #265

Earlier quoted context omitted.

Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!

... what? Yes? That's the definition of a deep link? The way you get notified is you open their app... This is a special case when you don't already have the app installed, but being able to read the clipboard without warning is it's own thing, but this specific deep link use-case is extremely benign...

Ideally, we’d be able to differentiate between local parsing (which I’d deem acceptable) and a remote request, but that quickly enters a gray area. How long after parsing do we validate a request? Is it even viable for a compiler to track the status of a property beyond assignment? And for how long? etc.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#376

Post by AnonC »

dahfizz wrote: post #236
tedivm wrote: post #114

Earlier quoted context omitted.

From my perspective it seems like Apple keeps releasing new privacy features and Android keeps being forced to catch up. What are the major privacy enhancements that Google has put out first?

I believe Android was the first to have fine grained app permissions where you could actually choose what an app has access to. iOS added that later.

Android had install time permissions for a long while. The user either had to allow all permissions asked by the app during install or not be allowed to install the app. On the other side, iOS had runtime permissions (nothing during installation) that were prompted by the system whenever the app needed a permission. When runtime permissions were added to Android 6, apps used to crash when not granted the permissions (so much so that some Android versions also started faking location data to apps when the user denied location access).

This took a few years to improve, but even today, there are Android apps that will refuse to work if you don't grant some (unnecessary, in the view of the user) permission. That kind of behavior is very, very rare among iOS apps.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#377

Post by AnonC »

dylan604 wrote: post #108
patrickyeon wrote: post #84

Earlier quoted context omitted.

I've only ever been an Android user, but for a while I was paying a lot of attention to iOS too. It seems to me like they've been back and forthing, as one side figures out some improvements, the other side more-or-less re-implements them on their next release with their own unrelated improvements. Seems like a good thing, really.

Not being an Android user, one of the negatives that was often talked about (maybe no longer true?) is that a lot of phones could not upgrade to new versions of Android. Is that still a thing, or was that limited to the lower tier phones?

It's still true. You'd be lucky to get updates beyond two years (so choosing the brand with this in mind is more important within the Android ecosystem). There are also devices that don't get updates after a few months of launch. Updates are also delayed by several months depending on the brand.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#378

Post by HeadsUpHigh »

p1necone wrote: post #212
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.

Ah yes permissions:

"-This clock app needs to access your photos, contacts, all the hardware the phone has and all your cloud accounts -No -The app can not function without the required permissions."

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#379

Post by chrsstrm »

PatrolX wrote: post #124

Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits…

It's even easier than that, just use ngrok. I recorded a demo video of a web interface running locally via ngrok. Left the tunnel up while the video uploaded to YouTube so I could send it privately to a colleague and during processing I started to see requests on my tunnel. YT scraped the URL from the video and was requesting it one char at a time until the entire address was complete. IIRC this was almost two years ago. That was also the day I decided no more visible private links in YT videos.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#380

Post by AnonC »

greggman3 wrote: post #227
patrickyeon wrote: post #68

Earlier quoted context omitted.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

This is a OS bug not an app bug. You can't expect millions of app developers to get this right. An app should not be allowed to read the clipboard until a user chooses to "paste". That's on the OS for allowing this behavior. It's silly to think that making it possible to read the clipboard at any time that some how all millions of app developers will use it correctly even if they have no malicious intent.

> An app should not be allowed to read the clipboard until a user chooses to "paste".

Sounds good. There are clipboard apps on iOS that work with a share sheet and also get the clipboard content when launched. They could be modified to have the user actively paste in the app to store something if the app is launched in the foreground (just like crude apps on a desktop would).

Post reply on HN