Popular iPhone and iPad Apps Snooping on the Pasteboard

#1

Post by clairity » Fri, Mar 13, 2020, 6:28 PM UTC

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#2

Post by diebeforei485 » Fri, Mar 13, 2020, 9:59 PM UTC

As web browsers have gotten more privacy-aware, native apps have fallen behind. This is just another example of that.

Recent versions of Chrome show a prompt when websites do this in javascript.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#3

Post by acwan93 » Fri, Mar 13, 2020, 10:03 PM UTC

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”.

I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#4

Post by ThePowerOfFuet » Fri, Mar 13, 2020, 10:06 PM UTC

acwan93 wrote: post #3

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”. I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

And that's fine — but it still empowers people who do care.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#5

Post by deadmutex » Fri, Mar 13, 2020, 10:09 PM UTC

diebeforei485 wrote: post #2

As web browsers have gotten more privacy-aware, native apps have fallen behind. This is just another example of that. Recent versions of Chrome show a prompt when websites do this in javascript.

> Recent versions of Chrome show a prompt when websites do this in javascript.

Yep, and here is the spec for others who might be wondering about how it works:

https://developers.google.com/web/updates/2018/03/clipboarda...

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#6

Post by _bxg1 » Fri, Mar 13, 2020, 10:16 PM UTC

> Apps on iOS and iPadOS have unrestricted access to the system-wide general pasteboard, also referred to as the clipboard.

Yikes. This is horrible, and really it's unacceptable given Apple's privacy rhetoric. Even the web doesn't have this vulnerability. And it's easy to fix, too! Why in the world should an app be able to see the clipboard? It should only see the text I enter into its fields (via pasting or otherwise).

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#7

Post by lazyjones » Fri, Mar 13, 2020, 10:18 PM UTC

Is there a MacOS utility that clears the pasteboard N minutes after its last content change?

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#8

Post by _bxg1 » Fri, Mar 13, 2020, 10:20 PM UTC

acwan93 wrote: post #3

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”. I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#9

Post by acwan93 » Fri, Mar 13, 2020, 10:27 PM UTC

_bxg1 wrote: post #8

acwan93 wrote: post #3

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”. I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?

Exactly. Obscuring the pasteboard or something along those lines is unfortunately the solution.

Re: Popular iPhone and iPad Apps Snooping on the Pasteboard

#10

Post by shoyer » Fri, Mar 13, 2020, 10:28 PM UTC

_bxg1 wrote: post #8

acwan93 wrote: post #3

I really hope we don’t start getting into a parade of dialogs going “X app requests permission to use Y”. I get why it’s important from a privacy-perspective, but most people aren’t going to care. They’ll just mash the “Allow” button until they get what they want.

I don't see why this even needs a dialog. What legitimate reason is there for an app to see my clipboard without me pasting anything?

Google Maps does this (at least on iOS), and it's actually pretty convenient. As soon as I click on the search bar, I can immediately click on my copied text to go there without doing the "tap and hold" dance.