I wish there was a way to view apps by permission- so I wouldn't have to audit every app individually. Is this possible?
Settings > Privacy > Permission manager
Settings > Apps > Special app access
Demo: Android 14 Clipboard Manager Data Leak Security Issue
11–20 of 21 posts
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#12Unless I'm misreading this, it sounds like an app can only suppress the clipboard paste toast if either: 1) It's a system app, and thus has permission to "legally" suppress the notification. This can be a problem for pre-installed third-party apps. But if your phone doesn't have those, you're fine. (More or less; I don't love the idea that system apps can suppress the notification, period.) 2) It's an app that you've…
The first scenario is a possibility for a lot of budget phones, as well as carrier-distributed phones. Both include bundled third party "system" apps, especially the budget phones where the bundleware is more likely to be from questionable devs. It's something most of us knew already, but it's just another reason why it's a bad idea to buy dirt cheap crapware-subsidized phones, and why it's better to buy phones throu…
If the main attack vector is "software preinstalled by shady manufacturers", I'd still file that under "nothingburger". There are many, many ways for shady manufacturers to do shady things with their OEM version of Android, and this is far from a game changer for them.
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#13Unless I'm misreading this, it sounds like an app can only suppress the clipboard paste toast if either: 1) It's a system app, and thus has permission to "legally" suppress the notification. This can be a problem for pre-installed third-party apps. But if your phone doesn't have those, you're fine. (More or less; I don't love the idea that system apps can suppress the notification, period.) 2) It's an app that you've…
Drawing over other apps is a problem too. On my OnePlus, I just checked, there are 23 apps with the permission to draw over other apps, but only 3 of those are the ones I've explicitly allowed.
20/23 apps are Google, OnePlus, or Android System apps. I never knew so many of them had this permission!
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#14Unless I'm misreading this, it sounds like an app can only suppress the clipboard paste toast if either: 1) It's a system app, and thus has permission to "legally" suppress the notification. This can be a problem for pre-installed third-party apps. But if your phone doesn't have those, you're fine. (More or less; I don't love the idea that system apps can suppress the notification, period.) 2) It's an app that you've…
Drawing over other apps is a problem too. On my OnePlus, I just checked, there are 23 apps with the permission to draw over other apps, but only 3 of those are the ones I've explicitly allowed. 20/23 apps are Google, OnePlus, or Android System apps. I never knew so many of them had this permission!
The 20 apps are all pre-installed from factory. If you don't trust those, then you need to change your device. There is no trivial way of removing them short of rooting or flashing a new ROM.
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#15Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. Sidenote: I really hope Android doesn't lose the ability to do things like these overlay windows. These types of "power user" features are often where innovation happens. It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a…
> Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. The point of the system overlay permission is to draw on top of everything else. Maybe Android should introduce some kind of overlay overlay overlay to overlay clipboard messages, but I think that would probably overcomplicate the API. Perhaps it's better to instead send a notification when an ap…
I think this makes a good case for something in between that can display the annoying popup chat bubbles, but can't override toasts.
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#16Earlier quoted context omitted.
Drawing over other apps is a problem too. On my OnePlus, I just checked, there are 23 apps with the permission to draw over other apps, but only 3 of those are the ones I've explicitly allowed. 20/23 apps are Google, OnePlus, or Android System apps. I never knew so many of them had this permission!
The 20 apps are all pre-installed from factory. If you don't trust those, then you need to change your device. There is no trivial way of removing them short of rooting or flashing a new ROM.
Even factory apps ought to be given the minimum permissions needed to do their job - otherwise someone will find an exploit for one and have an easier time doing evils.
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#17Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. Sidenote: I really hope Android doesn't lose the ability to do things like these overlay windows. These types of "power user" features are often where innovation happens. It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a…
> Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. The point of the system overlay permission is to draw on top of everything else. Maybe Android should introduce some kind of overlay overlay overlay to overlay clipboard messages, but I think that would probably overcomplicate the API. Perhaps it's better to instead send a notification when an ap…
An overlay buster buster
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#18Unless I'm misreading this, it sounds like an app can only suppress the clipboard paste toast if either: 1) It's a system app, and thus has permission to "legally" suppress the notification. This can be a problem for pre-installed third-party apps. But if your phone doesn't have those, you're fine. (More or less; I don't love the idea that system apps can suppress the notification, period.) 2) It's an app that you've…
> Seems like kinda a nothingburger?
Yep, it's a nothingburger (which also explains why it's not filed through a security disclosure and getting a CVE).
Just declaring draw over apps permission will also kick you into a much more rigorous Play Store review if you try to publish the app.
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#19Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. Sidenote: I really hope Android doesn't lose the ability to do things like these overlay windows. These types of "power user" features are often where innovation happens. It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a…
> Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. The point of the system overlay permission is to draw on top of everything else. Maybe Android should introduce some kind of overlay overlay overlay to overlay clipboard messages, but I think that would probably overcomplicate the API. Perhaps it's better to instead send a notification when an ap…
Or just make it so the system-wide Toast cannot be overdrawn, it will always stay on top.
Re: Demo: Android 14 Clipboard Manager Data Leak Security Issue
#20Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. Sidenote: I really hope Android doesn't lose the ability to do things like these overlay windows. These types of "power user" features are often where innovation happens. It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a…
[deleted]