Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

311–320 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#311

Post by LordDragonfang »

blisseyGo wrote: post #283
madeofpalk wrote: post #262

Earlier quoted context omitted.

In that Reddit thread the author of a Reddit app mentions that they look at the clipboard to see if you have a Reddit link, and offer to open that page in the app (as iOS offers no better way). On Twitter I saw a. Doing app mention they trigger the notification on every key press because they have custom ‘paste’ button that only shows when you have something copied.

Yep, for Apollo app, it makes sense why he does it. But for other apps like TikTok, it makes no sense. I wonder if the app also sends the clipboard data after that. Someone should look into network requests being made.

TikTok also has web URLs that they could open in the app, as do many other apps.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#312

Post by unityByFreedom »

andrepd wrote: post #203
unityByFreedom wrote: post #60

Earlier quoted context omitted.

> this still doesn't solve the problem of whether Apple themselves are abusing your privacy Eventually you have to trust someone. This added transparency from Apple is commendable. I support open source for publicly funded software, but if it's privately owned and funded, you can choose to buy and use it or not. Private companies are not under any moral obligation to open source their code or methods. Some people are…

>Eventually you have to trust someone. This added transparency from Apple is commendable. I support open source for publicly funded software, but if it's privately owned and funded, you can choose to buy and use it or not. Private companies are not under any moral obligation to open source their code or methods. Funny how you change your argument mid-paragraph. "It's okay! You have to trust somebody. Or maybe you don…

You have a choice about where you place your trust. You seem to want me to say "buy it" or "don't buy it" and I'm saying it's up to you.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#313

Post by AlexandrB »

cactus2093 wrote: post #149
speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

This is exactly why I am happy to see Apple cracking down more. I will grant you that this could very much be "innocent", but it's still completely unacceptable to me as a user. And just about every PM or founder I've ever worked with seems to think like this - when given the choice between the straightforward, obvious way to do something, and some crazy, brittle, privacy-abusing hack that might improve conversion by…

The mentioned photo change sounds awesome! I was not aware of this iOS 14 feature. Giving an app access to my entire photo album always seemed overly broad, especially given that photo EXIF data can give away other details like location.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#314

Post by callalex »

DaiPlusPlus wrote: post #285
vczf wrote: post #280

Earlier quoted context omitted.

By and large this is true. However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. I don't think Apple would allow that kind of permissions abuse, but apparently Google does.

> However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. Considering Citi’s corporate culture, I’d attribute this to incompetence rather than malice or a desire to spy on users. I’ll bet they’re using a third-party anti-spyware library to examine the Android FS for keyloggers/etc to protect their users’ security. It’s well-intentioned, bu…

No, it’s because they like laundering money and the profit that brings, and hate any feature that might prove their wrongdoing empirically.

https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET...

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#315

Post by callalex »

dahfizz wrote: post #236
tedivm wrote: post #114

Earlier quoted context omitted.

From my perspective it seems like Apple keeps releasing new privacy features and Android keeps being forced to catch up. What are the major privacy enhancements that Google has put out first?

I believe Android was the first to have fine grained app permissions where you could actually choose what an app has access to. iOS added that later.

As a checkbox prompt on install, yes. iOS has always and will continue a slightly different model of throwing a modular question up to the user at the moment the action that requires the permission first occurs. This gives the user more context about the question, but also gives more alert fatigue. Which is better is left as an exercise to the reader.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#316

Post by judge2020 »

beervirus wrote: post #277
kstrauser wrote: post #54

iOS already prompts for other things like "app Foo would like to know your location: Never, Only when open, Always". Users are use to this. I'd love a popup like: "TikTok wants to see what you've copied into your clipboard: Never, Once, Always, Uninstall that spyware". Then I could make informed decisions, like sure, my package tracker can see if there's a FedEx URL in my clipboard. I'm OK with that. There's literall…

Why is there programmatic access to my clipboard at any time other than when I click paste?

Not every text box is a Cocoa text box, so the paste functionality might need to be handled via code.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#317

Post by realusername »

rimjongun wrote: post #304
realusername wrote: post #205

Earlier quoted context omitted.

Anybody can have a look at the ROM to see if it makes sense whereas only Apple can realistically audit the iPhone.

You say “anybody” But I’m not a programmer, I would have no idea what I’m looking at. And trust me, neither would the vast majority of humans. Beyond that, have you considered the actual average user? You either never worked tech support or forgot. It’s bad out there, it’s like people are moving backwards with computer skills because of phones.

> You say “anybody” But I’m not a programmer, I would have no idea what I’m looking at. And trust me, neither would the vast majority of humans.

That's still a way better outcome than having a single uncountable company being able to do audits.

> Beyond that, have you considered the actual average user? You either never worked tech support or forgot. It’s bad out there, it’s like people are moving backwards with computer skills because of phones.

People are becoming worse with computer skills because manufacturers try very hard to remove owners from how their machine works, I'm not sure going further into this way will help. In a very locked down device like the iPhone, the phone owner can't even understand what it's doing even if they wanted to.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#318

Post by statictype »

patrickyeon wrote: post #68
speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

Well, the problem is we don't know why they are using it.

That almost makes the notifications useless.

Apple puts app developers through an annoying review process. It seems like the least they could do is check with the developer on why they want that access and see if its legit or not.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#319

Post by BoorishBears »

madeofpalk wrote: post #265
mrtksn wrote: post #117

Earlier quoted context omitted.

>It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo Okay, this could be simply a dynamic link library checking for a deep link in the clipboard. Why do this? To preserve the state after install. Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the ap…

Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!

... what?

Yes? That's the definition of a deep link? The way you get notified is you open their app...

This is a special case when you don't already have the app installed, but being able to read the clipboard without warning is it's own thing, but this specific deep link use-case is extremely benign...

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#320

Post by [deleted] »

statictype wrote: post #318
patrickyeon wrote: post #68

Earlier quoted context omitted.

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input fie…

Well, the problem is we don't know why they are using it. That almost makes the notifications useless. Apple puts app developers through an annoying review process. It seems like the least they could do is check with the developer on why they want that access and see if its legit or not.

[deleted]
Post reply on HN