Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

391–400 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#391

Post by hutattedonmyarm »

greggman3 wrote: post #222
xvector wrote: post #185

Earlier quoted context omitted.

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these ho…

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

There are cases where it's fine to access the clipboard without me pasting. My reddit app for example auto-detects reddit-links on my clipboard and asks if I want to open the link in the app if it finds one

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#392

Post by tspike »

bad_user wrote: post #384
DaiPlusPlus wrote: post #229

Earlier quoted context omitted.

That’s not my point: I’m arguing that apps like TikTok and Facebook are big enough that they could convince non-technical users (who are either ignorant-of, or just don’t care about, app permissions and privacy) to switch to an unofficial app-store where they could list their app without it being denied approval by Apple or Google for unreasonable app permission prompts. ...but the fact that unofficial app-stores for…

The scenario you're speaking of hasn't happened on Android. As a famous example of a popular app that eventually caved into Google's demands is Fortnite [1] and children are tech savvy (or at least motivated) enough to install from outside the app store. If Fortnite couldn't do it, then no, it's not easy to imagine TikTok doing it, especially given TikTok's market share is made of mobile users mostly, so no PC, no PS…

As extortionate as Apple’s fees are, I’m actually glad that they have a business model that isn’t dependent on invasion of privacy. Without them continually calling attention to it, Google would have little incentive to improve privacy.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#393

Post by neilparikh »

cactus2093 wrote: post #149
speedyapoc wrote: post #18

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

This is exactly why I am happy to see Apple cracking down more. I will grant you that this could very much be "innocent", but it's still completely unacceptable to me as a user. And just about every PM or founder I've ever worked with seems to think like this - when given the choice between the straightforward, obvious way to do something, and some crazy, brittle, privacy-abusing hack that might improve conversion by…

A similar problem is that if you want to save a photo from an app to your album, you need to give the app access to your entire album for some reason. I'm not sure that it's because there's no API for write access only, or app developers choose not to use it, but it's really annoying (and a little worrying: what if the app accidentally deletes ones of my photos?).

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#394

Post by IshKebab »

013a wrote: post #238
greggman3 wrote: post #227

Earlier quoted context omitted.

This is a OS bug not an app bug. You can't expect millions of app developers to get this right. An app should not be allowed to read the clipboard until a user chooses to "paste". That's on the OS for allowing this behavior. It's silly to think that making it possible to read the clipboard at any time that some how all millions of app developers will use it correctly even if they have no malicious intent.

A high speed collision happens on a freeway, killing both drivers. This is a car manufacturer bug, not a human bug. You can't expect millions of drivers to get driving right. A car should not be allowed to drive fast. How about: stop apologizing for billion dollar corporations. Fault can be placed on both the OS and applications. I expect better, from everyone.

Are you really suggesting that cars have never had bugs that cause crashes?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#397

Post by bad_user »

tspike wrote: post #392
bad_user wrote: post #384

Earlier quoted context omitted.

The scenario you're speaking of hasn't happened on Android. As a famous example of a popular app that eventually caved into Google's demands is Fortnite [1] and children are tech savvy (or at least motivated) enough to install from outside the app store. If Fortnite couldn't do it, then no, it's not easy to imagine TikTok doing it, especially given TikTok's market share is made of mobile users mostly, so no PC, no PS…

As extortionate as Apple’s fees are, I’m actually glad that they have a business model that isn’t dependent on invasion of privacy. Without them continually calling attention to it, Google would have little incentive to improve privacy.

Google payed Apple $12 billion in 2019 to remain the default search engine in Safari.

I hear this line about their business model all the time, however it is bullshit. Given the opportunity all companies will take the money. And I fear that it is nothing more than a conspiracy theory, without much evidence, much like anti-vaxxing.

Google these days is a very big target. The EU would love to have reason to slap them with another fine, given all the legal tax evasion they've been doing. Yet they've always been transparent about what they collect and have always been responsible with user data (versus Facebook).

Don't get me wrong, I enjoy the privacy features of my iPhone, it always fared better than Android in that regard, but it has nothing to do with Apple's tight grip of its App Store.

And Google Play takes a 30% commission too ;-)

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#398

Post by doctor_eval »

WA wrote: post #388
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta…

iOS 14 allows sharing specific photos:

https://www.macrumors.com/2020/06/24/ios-14-users-give-apps-...

Maybe contacts too, but I haven’t read that anywhere.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#399

Post by lgats »

samanator wrote: post #385
chrsstrm wrote: post #379

Earlier quoted context omitted.

It's even easier than that, just use ngrok. I recorded a demo video of a web interface running locally via ngrok. Left the tunnel up while the video uploaded to YouTube so I could send it privately to a colleague and during processing I started to see requests on my tunnel. YT scraped the URL from the video and was requesting it one char at a time until the entire address was complete. IIRC this was almost two years…

That's wild! What do you mean they were requesting it one character at a time? The URL itself? If so,how do you know that? Do you also own urls in that "character space" leading up to your URL?

Was it YouTube that was requesting the link (maybe for anti-phishing purposes?)

Or Googlebot?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#400

Post by tomduncalf »

WA wrote: post #388
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta…

Looks like photos is addressed in iOS 14 https://appleinsider.com/articles/20/06/24/apple-fine-tunes-...

Agree tighter control over contacts sharing would be nice but I don’t think it’s malicious on Apple’s part that this isn’t possible - they’ve quite clearly shown they are on the side of user privacy, but they do also tend to move at a fairly slow pace

Post reply on HN