iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes • Hacker News Board

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#571

Post by cosmojg » Thu, Jun 25, 2020, 6:23 PM UTC

DaiPlusPlus wrote: post #216

p1necone wrote: post #212

Earlier quoted context omitted.

Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies]( https://blog.codinghorror.com/the-dancing-bunnies-problem/ ). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loadin…

I wonder if location prompts would be more effective if, instead of asking "Allow 'Example App' to access your location while you are using the app?", they explicitly state "'Example App' would like to know precisely where you are. Would you like to share your exact location?". I feel like those adjectives, "precisely" and "exact", would go a long way toward encouraging people to put more thought into the decision. Similar wording could be used for other permissions, maybe in conjunction with a one-or-two-second timer on the buttons.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#572

Post by antpls » Thu, Jun 25, 2020, 6:45 PM UTC

llacb47 wrote: post #158

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this: https://github.com/llacb47/mischosts/blob/master/tiktok-host...

If I had to design it, I would not directly send the data to the central server. I would first store it for a period of time, then compress everything and then send it while the phone is inactive and plugged to the sector. Or I would build a model with the data on the phone, then send that to the central server. Both ways would be asynchronous.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#573

Post by lifeisstillgood » Thu, Jun 25, 2020, 6:56 PM UTC

codetrotter wrote: post #513

lifeisstillgood wrote: post #434

Earlier quoted context omitted.

The choice of only allowing access to specific actual photos seems an unusual one. I would have thought there was a big debate in Product Mgmt over this vs the more obvious allow an app access to a given album. One presumes the sticking point came when someone took a photo out of an album. Does that mean they are explicitly removing access? I don't see it as a huge issue... maybe there is some kind of technical hurdl…

I take a lot of photos and I use the album feature a lot. But when I am going to for example post a photo to Instagram I don’t at all want to have to put the photo in a dedicated Instagram album just so I can post it. That is to say, one mans “obvious solution” can be another mans annoyance.

Nailed it. That must be it :-)

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#574

Post by alpb » Thu, Jun 25, 2020, 7:11 PM UTC

SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

I have a feeling like many of the apps are reading the clipboard on the launch because they probably act on copied text (e.g. if it's a link or a number, they can use that to show a suggested user action).

Obviously I might be wrong, but we live in times where many applications are reverse engineered and their traffic is MITM'ed all the time. I'm not sure if anyone’s sending those clipboard contents outside the device. That would be a problem.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#575

Post by HanayamaTriplet » Thu, Jun 25, 2020, 7:25 PM UTC

Spivak wrote: post #569

yreg wrote: post #441

Earlier quoted context omitted.

How is manipulating clipboard not a problem? What if something replaces your fingerprint or bitcoin address?

An app being able to declare some operations to perform on the clipboard (overwrite, append, etc) that don't return any information about the contents are not a problem from a privacy or security perspective. At most they can be annoying.

If your clipboard contents were overwritten with an arbitrary wallet address immediately before you paste into an exchange's "Send BTC to..." field, that would be a pretty big problem.

I wouldn't expect that most people would double-check to make sure a series of gibberish characters matches what they expect, especially if they don't have any reason to suspect that paste wouldn't output exactly what they copied a moment ago.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#576

Post by Kiro » Thu, Jun 25, 2020, 7:46 PM UTC

patrickyeon wrote: post #68

speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

You ask all the questions from a company's perspective, presuming no users want this. As a user, I absolutely prefer the convenience.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#577

Post by jasonshaev » Thu, Jun 25, 2020, 7:48 PM UTC

cosmojg wrote: post #571

DaiPlusPlus wrote: post #216

Earlier quoted context omitted.

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies]( https://blog.codinghorror.com/the-dancing-bunnies-problem/ ). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loadin…

I wonder if location prompts would be more effective if, instead of asking "Allow 'Example App' to access your location while you are using the app?", they explicitly state "'Example App' would like to know precisely where you are. Would you like to share your exact location?". I feel like those adjectives, "precisely" and "exact", would go a long way toward encouraging people to put more thought into the decision. S…

This is a neat idea. Also, many apps don't need your EXACT location, just something like a zip code for convenience. AFAIK there is no mechanism for an App to request permissions to get a "rough" idea of where you are as opposed to a precise location

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#578

Post by dylan604 » Thu, Jun 25, 2020, 8:16 PM UTC

andy_ppp wrote: post #549

dylan604 wrote: post #284

Earlier quoted context omitted.

JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

Untrue, you can copy sure, but you cannot paste.

If you're using JS to read the clipboard, you don't need to paste. Assume that the purpose of reading the clipboard is not for a useful thing for the user but a nefarious use for the app/site maintainer. The would just send the read data back to their server without the user knowing.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#579

Post by VonGallifrey » Thu, Jun 25, 2020, 8:43 PM UTC

rimliu wrote: post #476

SAI_Peregrinus wrote: post #244

Earlier quoted context omitted.

You're both right. The walled garden has nothing to do with security, AND security isn't binary.

So walls and fences have nothing to do with security? Interesting. I will even say, world-shattering news.

Yes. First of because "walled garden" is just a metaphor for the type of system the App store represents and Second if you have "walls and fences" but with an open door where everyone can enter if they Pay 30% of their revenue then those walls are there for revenue generation and not for security.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#580

Post by mrgreenfur » Thu, Jun 25, 2020, 8:57 PM UTC

cageface wrote: post #368

mrgreenfur wrote: post #197

Earlier quoted context omitted.

No, because Apple makes money on subscriptions and retail purchases not on aggregating and reselling the data for advertisers.

Google doesn't sell data, it sells targeted access to users based on that data. Let's be precise if we're going to discuss the practical privacy implications of both platforms. Meanwhile if you use iCloud backups all your data is one subpoena away from law enforcement.

Correct. But why does google deserve to know everything about you? What does it matter if they can still browse everything about you and they happen to resell targeting. All still bad. I agree the Warrentless wiretaps are a problem for every American company, google included.

My point stands, apples revenue is not from privacy violating advertising and has no motivation for data collection beyond product improvement