Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

421–430 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#421

Post by cynix »

RandallBrown wrote: post #87
vxNsr wrote: post #22

Appears that a lot of third party apps are just using an older api that forces this notification to show. a lot less nefarious than it originally appears. Seems that iOS14 offers a specific new API to check if there's something on the clipboard without actually seeing it which is what all these apps are trying to do.

The API to check if the clipboard has contents has existed since iOS 10. > Starting in iOS 10, the UIPasteboard class provides properties for directly checking whether specific data types are present on a pasteboard, described in Checking for Data Types on a Pasteboard. Use these properties, rather than attempting to read pasteboard data, to avoid causing the system to needlessly attempt to fetch data before it is ne…

That doesn’t seem to stop the app from checking for, say, string content, and getting access to a copied password.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#422

Post by gorgoiler »

Can one app copy data into the clipboard and then another app paste it out?

They could even collude behind the scenes, once they’ve communicated over the clipboard as a channel to establish a link, to replace the original data in the clipboEOF[CITIZEN:8EF7720=FLAGGED]

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#423

Post by gorgoiler »

shakna wrote: post #355
spideymans wrote: post #348

Earlier quoted context omitted.

I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?

Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

> user-triggered event

“Click Reject All Cookies to exercise your GDPR rights!”

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#424

Post by willhay »

Crazy thing is that I would open TikTok on my phone and occasionally see a loading dialog that said "Pasting Clipboard" (from MacBook Pro). I finally freaked back in March and Googled it and found this... https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-ap...

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#425

Post by Cthulhu_ »

pwdisswordfish2 wrote: post #419
SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

"It seems like a ton of apps are abusing this feature:" Honest question: Why do we need this feature? As a user, I am happy to sacrafice whatever benefit it provides -- to end users -- to stop the abuse. Obviously the feature provides benefits to app developer personal data collectors. OK by me to remove feature.

I've never seen a "I will paste your clipboard for you" feature be used in any app, ever.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#426

Post by _-___________-_ »

WA wrote: post #388
alfalfasprout wrote: post #47

Earlier quoted context omitted.

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta…

What I want to see with Contacts is

1) a way for apps to display a view that shows the contact name for a phone number, with specified styling / sizing / etc, but without being able to determine what that contact name is.

2) an App Store rule that forbids apps from requiring contact access unless they can't function without it. WhatsApp forces you to provide contact access, giving Facebook your place in the social graph even if you don't use Facebook, even though WhatsApp should be usable (using phone numbers) without it.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#427

Post by Nullabillity »

tedivm wrote: post #114
patrickyeon wrote: post #84

Earlier quoted context omitted.

I've only ever been an Android user, but for a while I was paying a lot of attention to iOS too. It seems to me like they've been back and forthing, as one side figures out some improvements, the other side more-or-less re-implements them on their next release with their own unrelated improvements. Seems like a good thing, really.

From my perspective it seems like Apple keeps releasing new privacy features and Android keeps being forced to catch up. What are the major privacy enhancements that Google has put out first?

Android has supported piecemeal permissions for ages (only let app X access this one photo, or this one contact), which Apple seems to be starting to copy in iOS 14 (though, as usual, seemingly without a single thought to the long-term UX).

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#428

Post by chinesempire »

DaiPlusPlus wrote: post #216
p1necone wrote: post #212

Earlier quoted context omitted.

Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies]( https://blog.codinghorror.com/the-dancing-bunnies-problem/ ). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loadin…

This is not true.

my Android phone warns me if an app is trying to use features that require permission while in background and asks me if I want to revoke the permissions, enable it only while the app is active or let it use it always.

pretty easy to use and anyone can guess that the bus or car sharing app doesn't need to use GPS all the time

When the controller is a "smart" app store, you know what they delete, but you don't know what they keep and why they do it.

they chose for you and never ask you if you're okay with it or not, so basically it's not your phone, it's their phone.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#429

Post by chrsstrm »

samanator wrote: post #385
chrsstrm wrote: post #379

Earlier quoted context omitted.

It's even easier than that, just use ngrok. I recorded a demo video of a web interface running locally via ngrok. Left the tunnel up while the video uploaded to YouTube so I could send it privately to a colleague and during processing I started to see requests on my tunnel. YT scraped the URL from the video and was requesting it one char at a time until the entire address was complete. IIRC this was almost two years…

That's wild! What do you mean they were requesting it one character at a time? The URL itself? If so,how do you know that? Do you also own urls in that "character space" leading up to your URL?

If the URL was https://myurl.com/some/thing/here I started seeing:

https://myurl.com/s

https://myurl.com/so

https://myurl.com/som

https://myurl.com/some

etc.

It took me a good 10 minutes to realize what was happening, especially since I was using a temp ngrok tunnel and no one should have had that URL.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#430

Post by chrsstrm »

kevingadd wrote: post #390
samanator wrote: post #385

Earlier quoted context omitted.

That's wild! What do you mean they were requesting it one character at a time? The URL itself? If so,how do you know that? Do you also own urls in that "character space" leading up to your URL?

My guess is that each frame of the video was OCR'd for text, so as the author typed a URL in one character at a time it was producing unique substrings on-screen and the youtube bot dutifully tried to fetch each of those unique substrings

That seemed like the gist of it. I wasn't surprised that it was OCR'ing text, but I was floored that it recognized a URL and started firing off requests.
Post reply on HN