Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

541–550 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#541

Post by benhurmarcel »

Cthulhu_ wrote: post #425
pwdisswordfish2 wrote: post #419

Earlier quoted context omitted.

"It seems like a ton of apps are abusing this feature:" Honest question: Why do we need this feature? As a user, I am happy to sacrafice whatever benefit it provides -- to end users -- to stop the abuse. Obviously the feature provides benefits to app developer personal data collectors. OK by me to remove feature.

I've never seen a "I will paste your clipboard for you" feature be used in any app, ever.

The Apollo for Reddit app checks if you have a Reddit URL in the clipboard and proposes to open it if so.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#542

Post by snuxoll »

signal11 wrote: post #529
tomduncalf wrote: post #400

Earlier quoted context omitted.

Looks like photos is addressed in iOS 14 https://appleinsider.com/articles/20/06/24/apple-fine-tunes-... Agree tighter control over contacts sharing would be nice but I don’t think it’s malicious on Apple’s part that this isn’t possible - they’ve quite clearly shown they are on the side of user privacy, but they do also tend to move at a fairly slow pace

This seems to increase the amount of work a user has to do in practice. I suspect most users will end up sharing the entire library. From the link above: > There's also the entirely new option Select Photos..., which leads the user through to the Camera Roll to pick one or more images to share. It is specifically images that users can opt to share, rather than albums. > Which then means there is an issue that the nex…

> he solution is to implement a OS-level photo picker in iOS with a UI can't be over-ridden and which makes clear you're sharing your selected photos with $appName.

This has existed forever - in fact, for far longer than applications have had the option of requesting full access to your camera roll. Unfortunately most applications have decided they prefer to take over the experience, and provide absolutely no fallback option if you reject giving them access.

Apple really just needs to make it mandatory to present a UIImagePickerController instead of whatever "integrated experience" an app provides when permissions to the photo library are denied. That would have been a much saner solution than this abomination - I don't want Teams to have the ability to wander around my photo library just so I can share a quick snap of a whiteboard. But I don't get a choice, because denying permission just makes it throw an error message up saying it doesn't have access.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#543

Post by jeffhuys »

chrsstrm wrote: post #430
kevingadd wrote: post #390

Earlier quoted context omitted.

My guess is that each frame of the video was OCR'd for text, so as the author typed a URL in one character at a time it was producing unique substrings on-screen and the youtube bot dutifully tried to fetch each of those unique substrings

That seemed like the gist of it. I wasn't surprised that it was OCR'ing text, but I was floored that it recognized a URL and started firing off requests.

https://-- DROP TABLE videos;

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#544

Post by BFatts »

I find it interesting that people automatically assume nefarious reasons for accessing the clipboard... If your privacy is so important, don't use platforms you cannot trust. If that means not using a smart phone, then maybe you will do something positive for yourself.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#545

Post by bonestamp2 »

signal11 wrote: post #529
tomduncalf wrote: post #400

Earlier quoted context omitted.

Looks like photos is addressed in iOS 14 https://appleinsider.com/articles/20/06/24/apple-fine-tunes-... Agree tighter control over contacts sharing would be nice but I don’t think it’s malicious on Apple’s part that this isn’t possible - they’ve quite clearly shown they are on the side of user privacy, but they do also tend to move at a fairly slow pace

This seems to increase the amount of work a user has to do in practice. I suspect most users will end up sharing the entire library. From the link above: > There's also the entirely new option Select Photos..., which leads the user through to the Camera Roll to pick one or more images to share. It is specifically images that users can opt to share, rather than albums. > Which then means there is an issue that the nex…

Select photos seems reasonable and if it's implemented right then it should be no more work than I was about to do anyway (select specific photos to share).

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#546

Post by 013a »

IshKebab wrote: post #394
013a wrote: post #238

Earlier quoted context omitted.

A high speed collision happens on a freeway, killing both drivers. This is a car manufacturer bug, not a human bug. You can't expect millions of drivers to get driving right. A car should not be allowed to drive fast. How about: stop apologizing for billion dollar corporations. Fault can be placed on both the OS and applications. I expect better, from everyone.

Are you really suggesting that cars have never had bugs that cause crashes?

The only reason that would be suggested is if you're interpreting it as such.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#547

Post by the_gipsy »

whynotminot wrote: post #111
the_gipsy wrote: post #104

Earlier quoted context omitted.

not a single person, but the sum of all people looking at the different parts. that's how open source works.

I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could maybe be safer, but it far from guarantees it.

neither did I say it's automatically safe, nor define "safe" as in bug free.

The commented I replied to implied that one would walk through the entire stack, every line of code, to audit e.g. an app running on a phone. This is most certainly not what OP meant. Rather, on a whole OSS is mostly transparent, while proprietary software is not. There are of course bugs, but that's not the focus here with "safety".

What we care about is intention. Private companies's have a track record in implementing features that go directly against the benefit if their end-users, e.g. tracking or vendor-lock-in. These anti-features, like the one described in the article, are much harder to detect precisely because the software is proprietary.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#549

Post by andy_ppp »

dylan604 wrote: post #284
greggman3 wrote: post #222

Earlier quoted context omitted.

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

Untrue, you can copy sure, but you cannot paste.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#550

Post by andy_ppp »

gorgoiler wrote: post #423
shakna wrote: post #355

Earlier quoted context omitted.

Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

> user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”

This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
Post reply on HN