Popular iPhone and iPad Apps Snooping on the Pasteboard • Hacker News Board

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#91

Post by eknkc » Sat, Mar 14, 2020, 8:03 AM UTC

_bxg1 wrote: post #8

acwan93 wrote: post #3

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”. I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?

There are obviously clipboard managers that watch the clipboard changes and save a history (I can't live without one)

Some apps do little UX tricks like a parcel tracker app that I have would prompt saving a new parcel if it detects a tracking number in the clipboard.

Same as the last one; one of my banking apps detect IBAN numbers in clipboard, offer to initiate a wire directly.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#92

Post by hjnilsson » Sat, Mar 14, 2020, 8:03 AM UTC

wool_gather wrote: post #17

I wouldn't be surprised if the apps themselves were not directly responsible here -- that is, the code that's written directly by the app developers. Instead, it may very well be be some analytics/marketing SDK that has been included in the app because of a business request. These have no privilege separation: they run their code in the same context as the code that the app developers wrote. (Consider the example of…

I have personally seen apps that used the pasteboard to trigger debug ui / extra logging etc.

For example, if the clipboard contained “FPS” when started, an FPS counter would be shown in game.

Note: this was a long time ago, there are better methods now.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#93

Post by soulchild37 » Sat, Mar 14, 2020, 8:29 AM UTC

If the app is free, you are the product. Who knew?

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#94

Post by kevsim » Sat, Mar 14, 2020, 8:45 AM UTC

lazyjones wrote: post #7

Is there a MacOS utility that clears the pasteboard N minutes after its last content change?

Never seen a general purpose utility for this, but some apps clean up their own content. For example, 1password copies your 2FA codes automatically to the clipboard when you log in and then clears them out after a few seconds.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#95

Post by 0x0 » Sat, Mar 14, 2020, 8:52 AM UTC

This was quite obvious for a short while after Apple introduced cross-device pasteboards (handoff/continuity) - if your mac had recently copied something into its pasteboard, and you opened the facebook app on your iphone, the system would show a "Pasting from mac..." modal progress bar for a second even with no user interaction.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#96

Post by pvg » Sat, Mar 14, 2020, 9:21 AM UTC

surround wrote: post #71

IIRC Apple syncs (or can sync) your clipboard data to the cloud, which is an issue if you’re copying passwords.

It doesn't, the data is copied device to device.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#97

Post by hutattedonmyarm » Sat, Mar 14, 2020, 10:08 AM UTC

_bxg1 wrote: post #8

acwan93 wrote: post #3

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”. I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?

Convenience. Apollo for iOS (a reddit client) pops a "Open reddit link?" if you have a reddit url on your pasteboard. There are obviously other ways to solve this (e.g. allow pasting them into the navigation bar) but they're ever so slightly less convenient. IMHO it ultimately depends on the app / the developer. As for Apollo I trust the dev enough to not abuse it and only checking for reddit url to potentially navigate to. Others, e.g. TikTok, I wouldn't

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#98

Post by tinus_hn » Sat, Mar 14, 2020, 10:09 AM UTC

xenadu02 wrote: post #46

andrekandre wrote: post #29

Earlier quoted context omitted.

not sure, but i do seem to remember that passwords copied from the “passwords” screen in system preferences get removed after a minute or so... so that functionality seems to exist in some form... (if i am remembering correctly that is)

Having a "password" pasteboard might not be a bad idea. Disallow reading its contents except by built-in system password input fields.

Unfortunately the number one use case is the browser which doesn’t use these.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#99

Post by hutattedonmyarm » Sat, Mar 14, 2020, 10:11 AM UTC

_bxg1 wrote: post #12

shoyer wrote: post #10

Earlier quoted context omitted.

Google Maps does this (at least on iOS), and it's actually pretty convenient. As soon as I click on the search bar, I can immediately click on my copied text to go there without doing the "tap and hold" dance.

Maybe the iOS keyboard itself needs a "just tap" paste button? That would seem generally-useful.

That exists on iPadOS, but not on iOS. It's a lot less useful for anything which doesn't require a keyboard though, for example "long tap to paste an image/custom app object"

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#100

Post by ken » Sat, Mar 14, 2020, 1:35 PM UTC

nicky0 wrote: post #63

ken wrote: post #60

Earlier quoted context omitted.

Not efficiently. There's no "clipboard changed" notification on macOS. Such a utility would have to run in the background and constantly query the clipboard. And since the clipboard basically holds a list of types and a way to ask the owning application for data, you'd have to keep waking up the clipboard owner, too, to ask it for data. Would you check every type it declares? Some applications support dozens of types…

You can poll the changeCount property to quickly check if the clipboard has been updated. You would not need to constantly wake up the clipboard owner. To “clear” the clipboard you just upload a new clipboard with an empty string.

That would be cool, if true. It was not clear to me from the documentation that this number is guaranteed to increment whenever the contents change.

The value is described as counting "pasteboard ownership changes", and its use is to "determine whether you still have ownership". -clearContents doesn't say anything about necessarily changing it if you were already the owner, though that does seem to be the behavior today.

I suppose this could be one of those cases where we can go by what it actually does, not just what the documentation says it does. I hate doing that, because it has a way of coming back to bite me.