iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes • Hacker News Board

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#551

Post by [deleted] » Thu, Jun 25, 2020, 4:07 PM UTC

xvector wrote: post #182

llacb47 wrote: post #158

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this: https://github.com/llacb47/mischosts/blob/master/tiktok-host...

Genuine question, why don't companies proxy tracker data through a single host that the app also depends on to serve data? That way it wouldn't be possible for users to block individual hosts to prevent tracking. I guess it's not worth the effort though because laypeople won't care either way?

[deleted]

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#552

Post by raydev » Thu, Jun 25, 2020, 4:11 PM UTC

bzzzt wrote: post #444

Nullabillity wrote: post #418

Earlier quoted context omitted.

Then the sandbox is broken..?

Defense in depth right? First layer: iOS sandbox, second layer: App Store.

Currently, App Store doesn't just review safety and UX, it also reviews whether or not Apple simply likes your idea or if you are competing with a feature they've integrated into the OS.

If the App Store remains the only method for installing apps, and Apple continues to reject apps that they simply don't like, then it's not a healthy platform for consumers in the end.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#553

Post by anticensor » Thu, Jun 25, 2020, 4:36 PM UTC

davidajackson wrote: post #55

clipboard access should really be permissioned just like mic access etc

Real solution is to make the clipboard behave like a channel (both must be running and target must be on foreground), not like a buffer. No permission mess.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#554

Post by rescbr » Thu, Jun 25, 2020, 4:44 PM UTC

asveikau wrote: post #540

rescbr wrote: post #504

Earlier quoted context omitted.

Windows Phone’s hub concept was marvelous. As a user I don’t care if I’m messaging you though MSN Messenger* , Skype or XMPP; I just want to IM. Gaming hub integrating with Xbox Live was a nice touch, it felt like MS finally got the concept of an ecosystem. * let’s keep it time accurate :)

Except when you realize all of those implementations needed to be coded by Microsoft. There was no way for a third party to plug in. I heard some things from MS people that the clients for IM services were driven server side which would have made it hard and inelegant to add additional protocols. Nokia's maemo had this done with better execution. The SMS app had a plug-in for xmpp and I used it for Google talk. I thi…

IIRC you had to do server side push as Windows Phone 7 didn't support local notifications and always-on Internet connection. Some IM clients used some tricks to run in background, such as masquerading as a streaming audio player (that had always-on capabilities enabled) but you lost the music player capabilities of your smartphone when running those apps.

WP8 relaxed some of those restrictions but it wasn't enough to truly develop a IM client.

It's true that only Microsoft could create such integrations, but it was a business decision. On Windows Phone 7 era, regular developers couldn't deploy native code and you couldn't call native APIs directly from the managed .NET/Silverlight runtime. Native SDK wasn't available at all, but it was a regular Windows CE at its core.

Maemo's was way superior to Windows Phone. It's a shame that Microsoft trojan-horsed Nokia.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#555

Post by afterburner » Thu, Jun 25, 2020, 4:44 PM UTC

kemayo wrote: post #144

afterburner wrote: post #130

Earlier quoted context omitted.

Lol you realize this used to be true of iOS too? I know after a few years my 3GS definitely wouldn't be able to handle the next iOS version.

The iPhone 3GS was released in June 2009, and the first iOS release that didn't support it was iOS 7 in September 2013. 4 years is much better than current Android phones, though it's true it doesn't quite live up to the current Apple lineup where iOS 14 is going to support the 6S which will be 5 years old by the time it launches.

Even if iOS 6 could be installed on the 3GS, it wasn't advisable.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#556

Post by zzo38computer » Thu, Jun 25, 2020, 4:44 PM UTC

Seirdy wrote: post #401

scottoreily wrote: post #253

Earlier quoted context omitted.

And yet no one else has

Flatpak has done this better than iOS has. - Completely FOSS stack - Uses multiple repositories (no lock-in) - Everything is sandboxed with Bubblewrap - Fine-grained permission control that offers more than iOS: control whether apps can access the network, which directories an app can access, if it can print, and even whether or not it can access PulseAudio. - Cross-platform: runtimes are OCI container images and can…

Does its sandboxing support fake (or altered) access? That might be the additional permission control needed. For example, to grant fake access to the audio, the program will work but there will be no audio output (and all audio input will be silent); or you can specify to save audio to a file instead of making it immediately audible, or change the volume control for that program only.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#557

Post by lixtra » Thu, Jun 25, 2020, 4:46 PM UTC

INTPenis wrote: post #458

PatrolX wrote: post #124

Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits…

I was in a situation like this once recently. I was trying to send a password pusher link to my brother over Signal. The password pusher was set to expire after 1 day or 1 view. And my brother kept saying the link didn't work. Of course it doesn't work when Signal fetches it before him to make a preview! Had to set it to exactly 2 views and then he could view the password. And iirc the Signal-desktop release for Linu…

The password should have been shown after a POST request, not to a simple GET request.

Put a button “click her to see password, you got one chance” to trigger the POST.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#558

Post by ogre_codes » Thu, Jun 25, 2020, 4:46 PM UTC

systoll wrote: post #501

WA wrote: post #388

Earlier quoted context omitted.

I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta…

There's totally a middle ground between 'full access and no access'. Apps can show UIImagePickerControllers and CNContactPickerViewControllers whenever they want, without any permissions. They then get the photo[s]/contact info the user picks. Which is exactly what most apps actually need. WhatsApp has no good reason to look at any image you aren't explicitly choosing to share right now. The only user-facing WhatsApp…

> There's totally a middle ground between 'full access and no access'. Apps can show UIImagePickerControllers and CNContactPickerViewControllers whenever they want, without any permissions. They then get the photo[s]/contact info the user picks.

If they don't use this control you can also inject whatever photos you want into most apps using the share sheet. It does mean you have to exit the app and go to photos, but as you point out, it's the app maker's fault for not supporting the extremely privacy friendly `UIImagePickerController`.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#559

Post by WiseWeasel » Thu, Jun 25, 2020, 4:52 PM UTC

edoloughlin wrote: post #461

xvector wrote: post #185

Earlier quoted context omitted.

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these ho…

wonder if Apple is playing 4D chess here though Why 4D? Isn't chess just a 2D game with wormholes?

Are you suggesting the movement of knights (and possibly kings and rooks) can be explained by wormholes?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#560

Post by kllrnohj » Thu, Jun 25, 2020, 4:56 PM UTC

JimDabell wrote: post #323

dahfizz wrote: post #236

Earlier quoted context omitted.

I believe Android was the first to have fine grained app permissions where you could actually choose what an app has access to. iOS added that later.

No, it’s the other way around. In the beginning, Android showed you what an app could before you installed it, and it was an all-or-nothing approach – if you didn't want the app to do those things, your only choice was to not install it. In the beginning, iOS didn't have this, and instead it prompted you for permission the first time an app wanted permission to do something. Additionally, app review had rules that ap…

In the beginning iOS basically didn't have permissions at all. There were some random ones like GPS (and push notifications?!), but there was for example no permission to access contacts. Or photos. That didn't come until iOS 6.

So in the very very very beginning it was:

iOS: prompts for permissions, but almost nothing (including accessing user data) requires permissions anyway

Android: Granular permissions for everything, but only asked at install time.

Since then iOS has become "more Android-y" in adding increasingly more granular permissions, and Android has become "more iOS-y" in those permission grants being on-demand and time-gated.