Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is copying the contents of my clipboard on every keystroke

twitter.com

Post reply on HN
Print view View original

371–380 of 380 posts

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#371

Post by swiley »

filleduchaos wrote: post #197
swiley wrote: post #104

It’s interesting that GNU/Linux apps don’t seem to have this problem even though there’s limited rather than total curation. It’s almost like letting the community maintain and control the software results in better user experience.

They do have this _problem_, if you're at all aware of how X11 works. In fact, Linux literally does not have a built-in system clipboard.

Not this problem. The apps can access the clipboard but almost none of the ones you’ll find in Debian repos are exfiltrating data to a cooperation that way.

These apps have access to everything and don’t abuse that access.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#372

Post by efreak »

pacoverdi wrote: post #366
fingerlocks wrote: post #338

Earlier quoted context omitted.

Sure, I get it. LinkedIn's email plugin thing was a security nightmare. But in this case, the code is right there! Take a step back and look at the entire forest: The outrage is over an app accessing data specifically designed to be shared across applications. That's what Copy fundamentally means- make this thing globally available to all my programs. You can poll pbpaste/xsel in your terminal and generate a log of t…

> That's what Copy fundamentally means- make this thing globally available to all my programs Wouldn't that be: Copy means- "make this thing go into MY clipboard". Paste means- "make my clipboard available to THIS application".

Copy and paste are application-level interfaces; the operating system holds the data, but has always given it up on demand. I've actually seen some applications that use the clipboard as an IPC mechanism (most recently, a Python application, I don't recall what for, was wiping URLs from my clipboard to see if it was already running)

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#373

Post by pacoverdi »

efreak wrote: post #372
pacoverdi wrote: post #366

Earlier quoted context omitted.

> That's what Copy fundamentally means- make this thing globally available to all my programs Wouldn't that be: Copy means- "make this thing go into MY clipboard". Paste means- "make my clipboard available to THIS application".

Copy and paste are application-level interfaces; the operating system holds the data, but has always given it up on demand. I've actually seen some applications that use the clipboard as an IPC mechanism (most recently, a Python application, I don't recall what for, was wiping URLs from my clipboard to see if it was already running)

Historically, yes. But in a world of mobile OS with permissions everywhere, it would make sense to deny full read access by default.

I may be wrong but I thought that even websites cannot access clipboard content except in write mode. Even, I remember that long ago, a Flash script was commonly used to be able to copy stuff into it.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#374

Post by nix23 »

tornato7 wrote: post #367
tqi wrote: post #363

Earlier quoted context omitted.

If there is no legitimate reason for it to happen, should this be prevented at the OS level?

Yes. People copy passwords, SSNs, crypto wallet secrets, and more in a clipboard that pretty much any app or website or system service can see without permission. I'm surprised we haven't seen more attacks on it, honestly. I have long wanted to build a secure multi-clipboard, one where you can copy with Ctrl+shift+1, ctrl+shift+2 etc and paste with Ctrl+1 and Ctrl+2 It would keep those hidden from any app until expli…

Hmm good idea, maybe you can integrate that into Klipper:

https://userbase.kde.org/Klipper

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#375

Post by fingerlocks »

gpderetta wrote: post #121
victorkab wrote: post #76

Earlier quoted context omitted.

I have no dog in this fight, but I was at LinkedIn at the time, on teams that worked closely to this. I can assure you that these changes were not made to force log in. It was a recommendation from the security team. I know it's Hacker News and it's easy to criticize LinkedIn for shady growth practices and get praise for it. They often deserve it, but assigning malicious/growth intent for every change they make is mi…

Clicking on links on linkedin emails on android would redirect to the appstore every few clicks. Was that also recommend by the security team? Fixed by switching to firefox and blocking redirects.

That’s how deeplinking works.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#376

Post by cookiengineer »

OJFord wrote: post #289
cookiengineer wrote: post #263

Earlier quoted context omitted.

We were trying to recruit via LinkedIn for our startup but soon realized what a shitty business model LinkedIn has. We had to pay around ~5,00EUR for each and every click on "Apply" to our job posting, which doesn't mean they even filled out the form. And now, where LinkedIn is full of Indian scammers (not meant in a racist way, but it is definitely perceived that way) we had costs for a "Local Area" limited job post…

> full of Indian scammers (not meant in a racist way, but it is definitely perceived that way) (I'm not Indian but) the non-racist way to say that is 'full of scammers', since the scammers' nationality has nothing to do with your distaste for their behaviour.

I don’t know how my perception came to be like this during the recruitment time... and I’m very sorry for it. I know it’s a demographic perception and in no way I’m gonna extrapolate from that experience in future.

Also, there seems to be an Angular rickandmorty heroes-like tutorial somewhere available in the Indian speaking web, as literally all of the scammers had exactly the same codebase with various differing mistakes or variable names, but with identical structure in their github profile, and all uploaded it just a couple weeks ago.

(And they all claimed to have years of experience with it, of course)

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#377

Post by rdslw »

fingerlocks wrote: post #338
Lio wrote: post #318

Earlier quoted context omitted.

LinkedIn (Microsoft) is a company that previously used man-in-the-middle techniques to move people's private emails to its servers.[1] People no longer give them the benefit of that doubt because of the reputational damage these previous violations have caused. They should stop making "innocent" mistakes with other people's privacy and deal with this more professionally at the highest levels. If they don't people wil…

Sure, I get it. LinkedIn's email plugin thing was a security nightmare. But in this case, the code is right there! Take a step back and look at the entire forest: The outrage is over an app accessing data specifically designed to be shared across applications. That's what Copy fundamentally means- make this thing globally available to all my programs. You can poll pbpaste/xsel in your terminal and generate a log of t…

No it's not, and your thinking is completly bad from privacy standpoint.

PASTE operation is where I give consent, to MY clipboard content. Not COPY. Thinking that COPY gives consent is like all the ideas that i-take-user-date-unlsess-user-opts-out . It is not fine.

You shall NOT paste without my permission.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#378

Post by fingerlocks »

rdslw wrote: post #377
fingerlocks wrote: post #338

Earlier quoted context omitted.

Sure, I get it. LinkedIn's email plugin thing was a security nightmare. But in this case, the code is right there! Take a step back and look at the entire forest: The outrage is over an app accessing data specifically designed to be shared across applications. That's what Copy fundamentally means- make this thing globally available to all my programs. You can poll pbpaste/xsel in your terminal and generate a log of t…

No it's not, and your thinking is completly bad from privacy standpoint. PASTE operation is where I give consent, to MY clipboard content. Not COPY. Thinking that COPY gives consent is like all the ideas that i-take-user-date-unlsess-user-opts-out . It is not fine. You shall NOT paste without my permission.

I am describing how things are; you are describing how you want them to be.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#379

Post by gpderetta »

fingerlocks wrote: post #375
gpderetta wrote: post #121

Earlier quoted context omitted.

Clicking on links on linkedin emails on android would redirect to the appstore every few clicks. Was that also recommend by the security team? Fixed by switching to firefox and blocking redirects.

That’s how deeplinking works.

I'm not an expert, but i understand that redirecting to the app store is an explicit decision on part of the developer (and in Fact it only happens randomly), and a very anti-user one.

The security excuse is used as a way to increase conversion.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#380

Post by scarface74 »

bobthechef wrote: post #351
isignal wrote: post #218

An explanation from LinkedIn: https://twitter.com/eberger45/status/1278843576638570496 ------ Hi @DonCubed . Appreciate you raising this. We've traced this to a code path that only does an equality check between the clipboard contents and the currently typed content in a text box. We don't store or transmit the clipboard contents. ---------- An example of this is in a library we have open sourced, and you can find th…

Such explanations are not reassuring. The problem for me isn't whether LinkedIn is actually using the clipboard, it's the very fact that they have access to it and can do that in principle. Why do apps even have unrestricted access to the clipboard? Do we give apps unrestricted access to cookies? No.

Actually we do. Any app that uses the in process embedded web view on iOS has access to anything that you enter on the website including passwords and they have access to cookies. You might expect that from Chrome but what about your RSS news reader?

My preferred news reader Feedly uses the out of process embedded WebView so its a moot point.

Post reply on HN