Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is copying the contents of my clipboard on every keystroke

twitter.com

Post reply on HN
Print view View original

71–80 of 380 posts

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#71

Post by leephillips »

ebg13 wrote: post #61
_bxg1 wrote: post #5

Guess I'm never copying and pasting anything sensitive on my phone ever again. Still don't understand why clipboard-sniffing isn't behind a permissions flag.

> Still don't understand why clipboard-sniffing isn't behind a permissions flag. Screw permissions flags. Clipboard-sniffing is never justified. Moving data out of the clipboard should only ever happen by direct user request via the OS interaction layer.

This is so obviously, blindingly true that I am amazed it’s even possible for apps to do this.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#72

Post by A4ET8a8uTh0 »

Very not cool. I am a medium LinkedIn user, but now it is going to be limited strictly to a PC browser, where I have some control. I just uninstalled it from my cell. I got caught in the siren song of convenience.

Now how many other apps do this.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#73

Post by sdinsn »

oblio wrote: post #37
rkagerer wrote: post #21

Earlier quoted context omitted.

Well, once upon a time you trusted the code running on your device. In Chrome on Android, the flag you want is under Settings | Site Settings | Clipboard | Ask before allowing sites to read text and images from the clipboard , and I think it's on by default.

The question is, does Android itself have that flag?

No, in Android the app that is in focus can read from the clipboard without restriction

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#74

Post by xvolter »

methyl wrote: post #63
inetknght wrote: post #35

Earlier quoted context omitted.

Think it's just the app? Hope you don't have your clipboard events enabled in your browser Edit for those interested: tl;dr: "asynchronous clipboard API" [0] Overtly, it's used by shit news sites like WSJ, nytimes, and bloomberg to inject their shit into your clipboard when you copy-paste. A common thing I've noticed is selecting text, copying the text, and then pasting somewhere and seeing a link to the original art…

To read the clipboard, website needs explicit permission to do so, no way to go unnoticed.

Right. Firefox and Safari (iOS and desktop) haven't implemented the Clipboard.read functionality yet either, only Chrome has and it's only available on use action such as a click or keydown (and not available on touch or scroll events).

But they can copy to your clipboard for you, a lot of services use "Click to copy" features. But reading is much harder.

iOS before 14.0 appears to have allowed apps to read clipboard contents without making that clear to users. Now that you get a notification whenever an app reads the clipboard, it has become fairly clear a lot of apps are reading clipboards constantly. For what… we all wonder.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#75

Post by staller »

MathCodeLove wrote: post #53
rmrfstar wrote: post #10

If you're a multi-billion dollar company with a "government relations" team, it is better to ask for forgiveness than permission. If you're a random internet weirdo who uses a public interface in an unexpected way, you face decades in prison. [1] [1] https://www.wsj.com/articles/SB10001424052748704312104575299...

I'm not going to create an account with the WSJ just to read that article, but from the opening paragraph I don't see how it support your claim. It appears to be talking about something AT&T did?

If you cannot access the WSJ article, the random internet weirdo has a Wikipedia page that touches on some of it: https://en.wikipedia.org/wiki/Weev

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#76

Post by victorkab »

lostdog wrote: post #13
kevsim wrote: post #2

My hunch is these things are more boneheaded than nefarious. Probably looking for URLs to share or something silly like that and just implemented poorly. Obviously not good for the PR, but say sorry and fix the bug. Luckily this shouldn't happen much longer once iOS 14 is properly released.

A few years ago, linkedin purposefully changed their notification emails to have less information so you're forced to log in and read the notification on their platform. Linkedin is also widely known for when they scraped users contacts and then spammed them. Call it incompetence if you want, but there's a certain flavor of evil incompetence here.

I have no dog in this fight, but I was at LinkedIn at the time, on teams that worked closely to this. I can assure you that these changes were not made to force log in. It was a recommendation from the security team.

I know it's Hacker News and it's easy to criticize LinkedIn for shady growth practices and get praise for it. They often deserve it, but assigning malicious/growth intent for every change they make is misguided.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#77

Post by alt_f6 »

catalogia wrote: post #59

LinkedIn is a subsidiary of Microsoft. I know the title of this post is an excerpt from a tweet, not a headline, but I think it's generally appropriate to call out the parent company in cases like this. For instance: "Microsoft's LinkedIn app is copying the contents of my clipboard on every keystroke."

It is MS/LinkedIn, not LinkedIn.

-- Richard Stallman, probably

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#78

Post by _bxg1 »

rkagerer wrote: post #21
_bxg1 wrote: post #5

Guess I'm never copying and pasting anything sensitive on my phone ever again. Still don't understand why clipboard-sniffing isn't behind a permissions flag.

Well, once upon a time you trusted the code running on your device. In Chrome on Android, the flag you want is under Settings | Site Settings | Clipboard | Ask before allowing sites to read text and images from the clipboard , and I think it's on by default.

iOS very early-on took on a model of not trusting the software you install on it, and for good reason. Android and the web followed soon afterward. This is the expectation today. Doubly so given Apple's chest-beating about privacy. This clipboard scandal is unacceptable.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#79

Post by leephillips »

NickHoff wrote: post #36
robmiller wrote: post #17

One of my hobbies is looking at url strings with GET key/value pairs. Programmers must forget that they're visible to users. LinkedIn has a search workflow that shows "origin=TYPEAHEAD_ESCAPE_HATCH" which I've always found humorous.

Yeah I noticed that too. If you go to the profile page of someone who has the LinkedIn pro version and hover over the gold "in" symbol next to their name, it links to a URL containing upsellOrderOrigin=premium_badge_profile_upsell

That's pretty funny. It might as well say “sucker”.
Post reply on HN