Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

351–360 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#351

Post by jurip »

avianlyric wrote: post #259
filleduchaos wrote: post #170

Earlier quoted context omitted.

The contents of your clipboard _can_ be directly related to the functionality of an app. For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?"). Whether or not the convenience is worth it…

There a APIs in iOS (which existed before iOS 14) that allow you ask the OS if the clipboard content matches a pattern (e.g. is it a URL) that doesn’t trigger the warning in iOS 14. It does appear that lots of apps don’t use these APIs, the developers probably never knew the existed till now, but there is a privacy preserving method of the building the functionality you talk of.

Aren't they just checking with an UTI? So for example a package tracking app can't ask if it contains strings matching patterns describing common package tracking code formats?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#352

Post by drevil-v2 »

OldHand2018 wrote: post #150

In the coming days I feel as if we are going to see a lot more threads about the new privacy features in iOS 14. Apple has a video overview of a lot of the new stuff [1]. I suggest watching it (at 2x speed - they talk very slowly). Especially at 16:30 where they emphasize that SDKs are part of your app and that you the developer are fully responsible for the data collection of any SDK you include in your app. This is…

If by problem you mean end of laziness then sure. You can no longer drag and drop FB or google analytics SDK into your project, type in a few lines of glue code, email the product owner that you have added tracking capability into the app and head down to the pub to spend some of that well earned six figure developer salary.

Now I am gleeful about this because it's win-win for me as a consumer and software engineer. Better privacy and use of my data as a consumer. More $$ work as an engineer when all those analytic pipelines need to be re-architected and rebuilt.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#355

Post by shakna »

spideymans wrote: post #348
greggman3 wrote: post #334

Earlier quoted context omitted.

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.

I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?

Reading from the clipboard is allowed on a user-triggered event.

It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event.

Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#356

Post by bllguo »

abakker wrote: post #290
riquito wrote: post #215

Earlier quoted context omitted.

So if you can choose between pure and not pure, locked vs unlocked, is worse? Interesting selling point

For some of us, having a locked down, reliable, secure, and pure phone is a great solution. I don’t want iOS on my random experimental project laptop, for that I have Linux or windows, or vms. But, cellphones are not something I need to hack around on.

their point is that you can choose to have "pure" android or "unpure" - which is not an option apple provides. why is that worse?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#357

Post by jehna1 »

spideymans wrote: post #348
greggman3 wrote: post #334

Earlier quoted context omitted.

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.

I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?

The first time you did this your browser asked for a permission via browser's native permission modal

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#358

Post by masklinn »

avianlyric wrote: post #259
filleduchaos wrote: post #170

Earlier quoted context omitted.

The contents of your clipboard _can_ be directly related to the functionality of an app. For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?"). Whether or not the convenience is worth it…

There a APIs in iOS (which existed before iOS 14) that allow you ask the OS if the clipboard content matches a pattern (e.g. is it a URL) that doesn’t trigger the warning in iOS 14. It does appear that lots of apps don’t use these APIs, the developers probably never knew the existed till now, but there is a privacy preserving method of the building the functionality you talk of.

> There a APIs in iOS (which existed before iOS 14) that allow you ask the OS if the clipboard content matches a pattern (e.g. is it a URL)

I don’t think that’s the case. You can check if there’s a URL in the clipboard but that’s a UTI thing.

Most of the URLs would likely be in the “strings” section of the clipboard.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#359

Post by jurip »

manicdee wrote: post #246
CGamesPlay wrote: post #223

Earlier quoted context omitted.

>will you lose out by only checking the clipboard when the user hits your text input field? Is it that much to ask that you find the least offensive way to serve your user? In your toy example of my app's main screen being a text box where the user can insert a tracking code, yes, I do lose by making the user wonder every time "you know I have a tracking code why are you making me type it in?" In a more realistic exa…

Clearly there needs to be a way for the parcel tracking app to tell the OS, “I am looking for plain text strings that match this pattern.” Which iOS and macOS already have, they are called data detectors. When the message arrives notifying you of the tracking number, you can select “track this parcel” from the context menu. No need for an app to snoop on the clipboard.

I know what data detectors are, but I most certainly don't get any such tracking option for any of my messages containing tracking codes. I still need to copy those codes into Parcel, and find the automatic pasteboard reading useful. And UIPasteboard doesn't offer such an API, AFAICT.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#360

Post by arrrg »

musha68k wrote: post #306
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

Do you know if the new ios will bring back (?) fine grain controls over microphone access? You can either give rights to an app for access or no access at all, which is really bad and IIRC through the "while using only" option in ios versions before was more respecting of customer privacy. If Apple removed granular mic controls before the current ios version, I really don't understand why.

What iOS 14 does is it shows you a dot in the status bar when either the camera or microphone is used (with different colors for each).

In Control Center it will also show you which App recently used those.

So that’s not more fine grained control, but it can help you understand when someone is abusing the permission.

Post reply on HN