Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

501–510 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#501
post #388

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta…

There's totally a middle ground between 'full access and no access'. Apps can show UIImagePickerControllers and CNContactPickerViewControllers whenever they want, without any permissions. They then get the photo[s]/contact info the user picks.

Which is exactly what most apps actually need.

WhatsApp has no good reason to look at any image you aren't explicitly choosing to share right now. The only user-facing WhatsApp feature that requires Photo library access is the scrolling list of recent photos on top of the in-app camera.

WhatsApp has a better case for asking to continually scan your contacts to show you people with accounts. But instead of just falling back to asking for a phone number when you don't give permission, it could show the contact picker, and check the accounts you pick.

Unfortunately, in both cases, WhatsApp takes the all-or-nothing approach - it asks for the blanket permission, and has no fall-back if it is denied.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#502

Earlier quoted context omitted.

Looks like photos is addressed in iOS 14 https://appleinsider.com/articles/20/06/24/apple-fine-tunes-... Agree tighter control over contacts sharing would be nice but I don’t think it’s malicious on Apple’s part that this isn’t possible - they’ve quite clearly shown they are on the side of user privacy, but they do also tend to move at a fairly slow pace

The choice of only allowing access to specific actual photos seems an unusual one. I would have thought there was a big debate in Product Mgmt over this vs the more obvious allow an app access to a given album. One presumes the sticking point came when someone took a photo out of an album. Does that mean they are explicitly removing access? I don't see it as a huge issue... maybe there is some kind of technical hurdl…

Agreed. The semantics should be like and let me pick one or more each time.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#503

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

So then why people can't run their hand inspected code on their iOS devices they own ? Why can't people run good privacy respecting GPLv3 licensed applications ?

The walled garden actually makes it harder to run software you and others can check to be sucure, instead you have to depend on some opaque QA somewhere in Apple to check that for you.

Not to mention you can't elect to use software that has features blocked by default for security reasons where you are sure it will not misuse them as you have audited the source (or even written it yourself!).

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#504

Earlier quoted context omitted.

Roughly speaking, current OSs "stop" at tools for interacting with data, and the hardware behind it. In this world where we expect internet access, I'm beginning to think OSs need to manage certain types of data more proactively. I'm trying to wrap a general point around your concerns about contacts. Contacts seem one of the data types that need something approaching OS level tooling. For me, another is "tags". I wan…

That rival was Windows Phone 7.5 through 8.5 They had a People hub that collated all your contacts and had reasonable sharing mechanisms for the data. HERE was essentially that places concept. I'm sure if Windows Phone had kept traction, it would be integrating your smart device health data into live tiles and a hub interface for all the metrics.

Windows Phone’s hub concept was marvelous. As a user I don’t care if I’m messaging you though MSN Messenger* , Skype or XMPP; I just want to IM. Gaming hub integrating with Xbox Live was a nice touch, it felt like MS finally got the concept of an ecosystem.

* let’s keep it time accurate :)

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#505

I wonder how the clipboard API could be fixed. I suppose that the current scheme is that apps are monitoring paste events, and when it happens have a look at the clipboard for copied data. Perhaps the clipboard shouldn't be visible at all, and only when the user decides to paste content should the targeted app receive a "paste" message with the copied data (or perhaps some more complicated selection mechanism with a…

I think we should have some kind of "clipboard firewall" where you can restrict if a clipboard copy operation in an app X could be pasted in app Y.

We have developed a free Windows app and will release it soon.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#506

Earlier quoted context omitted.

I really think Apple will buy DuckDuckGo at some point. The question is, to what extent will Apple make DuckDuckGo (or whatever they'll rename it to) available for non-Apple platforms?

If they do, they are buying what exactly? A shell around Bing? Please, they are not going to leave $10 billion per year on the table.

They would if they could position that loss of $10 billion into increased sales. Is that plausible? Maybe not, but it is certainly possible.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#507

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

So then why people can't run their hand inspected code on their iOS devices they own ? Why can't people run good privacy respecting GPLv3 licensed applications ? The walled garden actually makes it harder to run software you and others can check to be sucure, instead you have to depend on some opaque QA somewhere in Apple to check that for you. Not to mention you can't elect to use software that has features blocked…

That's not what iPhones are for. The android market is more for the tinkerer historically, Apple is just supposed to work the way it was intended, always was that way. Android is moving that direction too so not sure what to choose now?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#508
post #444

Earlier quoted context omitted.

Defense in depth right? First layer: iOS sandbox, second layer: App Store.

How about giving people a choice? If you like defense in depth: App Store. If you like freedom of choice: Open Market Store and side-loading.

[deleted]

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#509

Earlier quoted context omitted.

TikTok also has web URLs that they could open in the app, as do many other apps.

That’s a different situation though. iOS supports universal links, so a website and iOS application can indicate that when you open a link to the website but have the application installed, the application opens and takes you to the content. This is what TikTok can use to open links to TikTok in the application. But this isn’t a general purpose website => app association. Only the website owner can allow an applicati…

It’s worth noting that if iOS allowed for setting default apps like other operating system this wouldn’t be as much of an issue because then I could always open a reddit link in the app of my choice and no longer need the clipboard workflow.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#510
post #388

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta…

In fact, I'd much prefer to share with apps like WhatsApp (although I don't use it anymore) and Telegram only the contacts I manually select. There's no reason for them to know all barbershops I ever called too, and I don't even really need to know that an acquaintance of mine started using Telegram, I only contact those who I know to use Telegram beforehand anyway.
Post reply on HN