Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

twitter.com

Post reply on HN
Print view View original

581–590 of 613 posts

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#581

Post by whynotminot »

Seirdy wrote: post #403
whynotminot wrote: post #111

Earlier quoted context omitted.

I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could maybe be safer, but it far from guarantees it.

Being able to inspect the code is a necessary but insufficient measure for being secure. If you cannot inspect the source code, you are not fully aware of how the program works. Tools like strace can help you analyze a program's behavior from the outside, but you get limited insight into its internals (e.g., what algorithms is it using?). Being open source does not automatically make software more secure. A successfu…

How often do you inspect the code of the open source programs you use every day? How about when updates come out? Do you check again?

Or, do you trust that someone has looked at it? How much faith do you have in someone out there in the community?

My point isn't that open source isn't a good thing--my point is that it's not the silver bullet a lot of people blindly assume it to be. Hence the second line of my post:

> In theory it means something could maybe be safer, but it far from guarantees it.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#582

Post by tekknik »

overheadnoise wrote: post #440
_-___________-_ wrote: post #426

Earlier quoted context omitted.

What I want to see with Contacts is 1) a way for apps to display a view that shows the contact name for a phone number, with specified styling / sizing / etc, but without being able to determine what that contact name is. 2) an App Store rule that forbids apps from requiring contact access unless they can't function without it. WhatsApp forces you to provide contact access, giving Facebook your place in the social gr…

WhatsApp works so well because it is tied into the same contacts that you already have on your phone. Without access to your phone’s contacts you would need to set up and manage an entirely separate set of contacts. Right now, Grandma could download WhatsApp and instantly start chatting with her granddaughter without having to remember what her phone number is because it’s already there. That’s a major selling point…

You can easily solve this with UX. Select new message, show the picker, select one or more contacts and then you have the identifier you need and you don’t need blanket permissions.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#583

Post by tekknik »

WA wrote: post #412
awolf wrote: post #404

Earlier quoted context omitted.

Both added in iOS 14. I guess Apple's not "full of shit" anymore.

Photos: just saw it, great news. Contacts: didn’t find a good source. This talks about "contacts autofill", not sure what that means exactly: https://www.apple.com/ios/ios-14-preview/features/

“Instead of sharing your entire Contacts list in third-party apps, you can now type individual names to automatically fill their corresponding phone numbers, addresses, or email addresses in fields that request it. The autofill happens on your device, and contacts are not shared with third-party developers without your consent.“

This is pretty clear to me, you type a name, it’s looked up in your contacts by the OS, data is retrieved if there is a match and placed in the form. This is not the same as sharing an individual contact and allowing the app to continue to read it later, but still gives you a means to give contact data to an app without giving it access to the entire list.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#584

Post by tekknik »

bad_user wrote: post #384
DaiPlusPlus wrote: post #229

Earlier quoted context omitted.

That’s not my point: I’m arguing that apps like TikTok and Facebook are big enough that they could convince non-technical users (who are either ignorant-of, or just don’t care about, app permissions and privacy) to switch to an unofficial app-store where they could list their app without it being denied approval by Apple or Google for unreasonable app permission prompts. ...but the fact that unofficial app-stores for…

The scenario you're speaking of hasn't happened on Android. As a famous example of a popular app that eventually caved into Google's demands is Fortnite [1] and children are tech savvy (or at least motivated) enough to install from outside the app store. If Fortnite couldn't do it, then no, it's not easy to imagine TikTok doing it, especially given TikTok's market share is made of mobile users mostly, so no PC, no PS…

This is definitely happening already, all the Mac App Store devs that left that store for their various reasons, some of them pushing updates only to their site forcing me to move away from the App Store, and therefore Apples guidelines making them behave properly. So this is happening and it is being abused, see Zoom using preinstall scripts. This wouldn’t have happened if the Mac App Store was the only way to install an app on a mac.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#585

Post by scarlac »

nuker wrote: post #523
SirensOfTitan wrote: post #32

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_cat…

> It seems like a ton of apps are abusing this feature Can they, if Background Refresh is off for the app? I allow it only for Apple apps.

Generally, no. But there are ways for an app to stay active in the background. Some are grounds for App Store suspension. Music playing apps may stay somewhat active in the background. However, I don't know if the clipboard API will still work when an app is in the background.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#586

Post by jshen »

rahkiin wrote: post #414
luckylion wrote: post #407

Earlier quoted context omitted.

The point was "it's an OS feature, not an Appstore feature, so Apple's Walled Garden approach has nothing to do with that feature, Apple's OS has". It's working. But not because of Apple's Appstore policies.

With sideloading apps could use private APIs that circumvent these policies maybe

The OS can stop an app from using certain APIs. This has nothing to do with the walled garden. ios tells you when an app is using your location in the background, it can do this for side loaded apps as well. It then allows you to disable it for that app, which it an also do for side loaded apps.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#587

Post by j45 »

j45 wrote: post #374
shawnz wrote: post #77

Earlier quoted context omitted.

Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.

I carry an Android. In Android, you and your data is the product, nothing else. In Apple the phone is the product.

Instead of drive by negging, happy to chat about why.

I've probably had a smartphone as long as anyone. And I hope it's not just because some people work at Google. :)

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#588

Post by guug »

anchpop wrote: post #303
xvector wrote: post #186

Earlier quoted context omitted.

I can't imagine being one of the PMs/higher-ups that decided to allow clipboard content to be shared willy-nilly like this. Like, what must be going through their minds when they make decisions like this? "User experience at all costs?" Seems contrary to their stance on privacy.

Personally I couldn't care less about google seeing whatever junk I sometimes have in my clipboard if it means I can more quickly go to the address I'm looking for

and I'm sure there are many who couldn't care less about the malware running on their windows machine as long as they can browse facebook. What's your point?

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#589

Post by _-___________-_ »

overheadnoise wrote: post #440
_-___________-_ wrote: post #426

Earlier quoted context omitted.

What I want to see with Contacts is 1) a way for apps to display a view that shows the contact name for a phone number, with specified styling / sizing / etc, but without being able to determine what that contact name is. 2) an App Store rule that forbids apps from requiring contact access unless they can't function without it. WhatsApp forces you to provide contact access, giving Facebook your place in the social gr…

WhatsApp works so well because it is tied into the same contacts that you already have on your phone. Without access to your phone’s contacts you would need to set up and manage an entirely separate set of contacts. Right now, Grandma could download WhatsApp and instantly start chatting with her granddaughter without having to remember what her phone number is because it’s already there. That’s a major selling point…

I understand that. I'm just saying that there should be a middle ground between "give Facebook full access to my entire contact list" and "cannot use the app at all". For example, WhatsApp should be able to trigger a contacts picker, without needing to have access to the full list of contacts. And it could even be able to show a styled view for "the contact name for this phone number" without needing to know what the name is.

WhatsApp does work if you revoke Contacts permission after setting it up, but IIRC you can't onboard when you first install the app if you don't grant it. Forcing the granting of the permission should be against App Store rules.

I use WhatsApp after revoking its contacts permission and it's pretty much fine. As an aside, same with Signal, and I really don't understand why a supposedly privacy-focused app like Signal nags hard to get contacts permission when it works perfectly fine without; it even shows people's chosen nicknames next to their numbers.

Re: iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

#590

Post by _-___________-_ »

WA wrote: post #449
overheadnoise wrote: post #440

Earlier quoted context omitted.

WhatsApp works so well because it is tied into the same contacts that you already have on your phone. Without access to your phone’s contacts you would need to set up and manage an entirely separate set of contacts. Right now, Grandma could download WhatsApp and instantly start chatting with her granddaughter without having to remember what her phone number is because it’s already there. That’s a major selling point…

I revoked Contacts access in WhatsApp a year ago. It works just fine. Problem is: WhatsApp only shows the phone numbers in the list and NOT the usernames of people. This is rather annoying, because I don't know any phone numbers by heart. Profile pics help a bit, but people change them and often don't have pictures of themselves.

Signal shows the nicknames next to the numbers which is a really nice feature and makes it pretty much perfectly usable without contacts permission, except that it constantly nags to grant the permission.
Post reply on HN