Earlier quoted context omitted.
I don’t disagree but the overflowing of permission prompts is how we get people just clicking Yes to everything. There is a balance. Location services are worth of a permission, but the clipboard seems a bit on the trivial side of things. Then again, people paste passwords, so...
> Then again, people paste passwords, so. It’s more serious than that, current security best practice is telling everybody to use a password manager. People are being told that pasting passwords is “the right way to do things”. And that behaviour (at least for me) has morphed into keeping account numbers, credit card numbers, and other important private information in the password manager, and copy pasting those when…
Popular iPhone and iPad Apps Snooping on the Pasteboard
81–90 of 107 posts
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#82Earlier quoted context omitted.
not sure, but i do seem to remember that passwords copied from the “passwords” screen in system preferences get removed after a minute or so... so that functionality seems to exist in some form... (if i am remembering correctly that is)
Having a "password" pasteboard might not be a bad idea. Disallow reading its contents except by built-in system password input fields.
Of course, this only solves the problem for passwords.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#83Would be interesting to see this correlated with network logs to see if the apps phone home or just process it locally.
Now you'd never know if the app buffers until a convenient time but a less sophisticated implementation would be instant giveaway.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#84Some apps use this to offer to open an URL in the app. "Your clipboard contains a link to a $localnewspaper article, do you want to open it?"
The Deliveries app offers this with tracking numbers and it's very helpful
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#85Something that confuses me: Windows app can do this. Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes. The API is ancient, well documented, and provides no feedback when it's being used. And some apps indeed use it, one obvious one is remote desktop apps use it to "sniff" what's in the clipboard to mirror it along. Is there a reason whatever s…
They're not.
One of the ways Tor users are being identified is by snooping on their pasteboards from collaborating apps.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#86Something that confuses me: Windows app can do this. Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes. The API is ancient, well documented, and provides no feedback when it's being used. And some apps indeed use it, one obvious one is remote desktop apps use it to "sniff" what's in the clipboard to mirror it along. Is there a reason whatever s…
This is one reason why KeepAss (at least on linux) can use xdotool for writing passwords. You can of course use the clipboard too but the app warns that it is not safe.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#87There are probably other legitimate uses of this, but one is dictionary/translator apps. I can copy a word in Japanese, open my dictionary app, and it will automatically open the entry for the clipboard contents without my needing to take extra steps.
This is a really tiny bit of convenience in return for allowing every app to read whatever is on your clipboard whenever they like it.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#88If iOS apps are snooping on the pasteboard/clipboard, then surely many Android apps are doing so too. It's worrisome specially when copy-pasting from password managers. Not sure if 1Password, LastPass, Dashlane etc. offer any protection.
Android recently [1] blocked app background access to the clipboard. 1: https://www.xda-developers.com/android-q-blocks-background-c...
This is about apps snooping in the foreground, which is still possible in Android. I don't think iOS offers background access at all.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#89Something that confuses me: Windows app can do this. Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes. The API is ancient, well documented, and provides no feedback when it's being used. And some apps indeed use it, one obvious one is remote desktop apps use it to "sniff" what's in the clipboard to mirror it along. Is there a reason whatever s…
Not at all, hence the move into UWP and for those that insist in staying with Win32, they get their sandbox as well since introduction of MSIX.
On the upcoming Windows 10X, each Win32 gets their own little world, as the next step since Microsoft decided to merge UWP and Win32 sandboxing concepts.
Re: Popular iPhone and iPad Apps Snooping on the Pasteboard
#90Something that confuses me: Windows app can do this. Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes. The API is ancient, well documented, and provides no feedback when it's being used. And some apps indeed use it, one obvious one is remote desktop apps use it to "sniff" what's in the clipboard to mirror it along. Is there a reason whatever s…
These security trade-offs are not really OK on desktop either, but Windows (and macOS) have a long tail of backwards compatibility they are trying to maintain and slowly steer towards similar security levels (as in the case of the mac app store or the windows store platform). Both of those platforms are struggling to do that although have made some incremental progress but nowhere near the degree that iOS has. iOS wa…
The Windows 10X sandboxing for Win32 is yet another step into that direction, each application gets their own little world thinking that they still own the PC, when in fact they are part of a Windows container.