iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

https://twitter.com/jeremyburge/status/1275896482433040386

by georgespencer • 6 years ago

1847 590 6 years ago

I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin.

I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

riskable2• 6 years ago

The problem is that iOS doesn't differentiate between a call that merely checks for the presence of a clipboard entry (e.g. so you can enable "Paste" in a menu/submenu) and actually copying the contents of the clipboard.

The workaround (for legitimate apps) is to simply always keep that "Paste" option enabled--even if the clipboard is empty. That way you won't freak out your users and only suffer the most minor of usability consequences.

Having said that I don't think TikTok has any relevant functionality such as enabling a "Paste" option so... Most likely nefarious!

selsta• 6 years ago

iOS differentiates between this since iOS 10:

https://developer.apple.com/documentation/uikit/uipasteboard...

Also iOS 14 has new clipboard related APIs to further check the content without actually accessing it.

pininja2• 6 years ago

I don't think TikTok has any relevant functionality

Does pasting text into a video as an annotation require “Paste” to be enabled in this way?

WrtCdEvrydy2• 6 years ago

this is weird, you usually can't past data from clipboard (part of the browser sandbox). copying into the clipboard is free, pasting is not.

Edit: This seems to be the app TikTok, not a website.

moonchild• 6 years ago

It is a risk. There's an easier solution, though.

about:config -> dom.event.clipboardevents.enabled=false

ciarannolan2• 6 years ago

A Yubikey or similar device is a good way to mitigate the damage of having your password manager's password stolen.

https://bitwarden.com/help/article/setup-two-step-login-yubi...

rvz• 6 years ago

And for macOS users, Touch ID takes this further without any devices, dongles or passwords, which 1Password, Dashlane, etc already supports.

sgloutnikov• 6 years ago

For this reason, I switched to using a PIN for Bitwarden in the browser plugin. I don't have to use my master password every time.

nmaggioni• 6 years ago

I had the same exact concern, and I haven't been able to find reliable confirmations on this being completely impossible either.

It's easily testable, though, that a webpage that isn't focused (because an extension's pane is open) doesn't receive input events. Likewise, Chrome [1] and Firefox [2] extensions themselves cannot bind to relevant keys for example. All in all I would say that going through an empty tab is unnecessary - even though I got into the habit of doing it as well - and even if this wasn't true 2FA should be enough to thwart most malicious actors.

[1] https://developer.chrome.com/extensions/commands [2]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

odensc2• 6 years ago

Well, you probably couldn't find any confirmation because nothing in the security world is completely impossible :) Webpages aren't supposed to be able to receive input events when the extension popup is open, but there could still be an unknown vulnerability in Chrome/Firefox.

So if you care enough it's best to mitigate that risk by using the standalone application for your password manager, or better yet use a completely separate device like your phone!

odensc2• 6 years ago

On Chrome at least, Bitwarden has it's own extension popup window with the vault. This is a completely separate web context. There's no way for the open website to detect your keystrokes barring a vulnerability in Chrome itself.

If you really want to be safe, you should use the standalone desktop apps and skip the browser extension altogether. Doing that empty tab thing probably doesn't protect you from anything.

neetodavid• 6 years ago

I took a short look at this and it appears to be a work in progress that varies between browsers...

Chrome implements a "clipboard-read" permission that can be requested by calling navigator.clipboard.read(). When a page calls that it will display a permission request dialog (like those asking for permission to show notifications on seemingly every single news web page). A little clipboard icon will also appear in the nav bar showing the status of the permission (visible after a read attempt is made during that visit)

Firefox is apparently on track as well, although for now the clipboard.read function is not implemented for pages and can only be called by extensions. I'm not sure what the permission dialog for extensions is like.

https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A...

So... it may be safe. But it is a work in progress and each browser is different. I've only checked the most well-documented method for reading the clipboard... maybe there is some other half-implemented feature or event listener that happens to leak some clipboard data...

_6fmb2• 6 years ago

Hopefully we can turn this off, this is going to destroy usability be very annoying.

adamhearn• 6 years ago

You mean so you can snoop from the user without being detected?

_6fmb2• 6 years ago

There are a lot of valid usecases for clipboard saving, I don't have an iOS app but I run CopyClip which would be kinda ruined by this "feature".

xsmasher2• 6 years ago

The developer can fix it by either (1) querying "is there clipboard content?" instead of copying it every few keystrokes or (2) stop altogether if there is no legit purpose.

It sounds like this feature is working as intended - closing was was a silent security risk.

beamatronic2• 6 years ago

Why does any app have access to the clipboard? Seems like a big security hole.

csa• 6 years ago

In order to know when you should enable the paste option.

It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

landryraccoon• 6 years ago

Couldn't IOS just have a peek API that tells the application if the clipboard is empty or not without revealing it's contents?

m0xte• 6 years ago

Perhaps the destination should define whether or not you can paste into it and the OS can provide that option instead. This looks like a violation of “tell, don’t ask”.

beamatronic2• 6 years ago

I should be able to paste into specific GUI elements that allow pasting. The application presenting the GUI element to me should be blind to whether I typed that data, or pasted it into there.

creato• 6 years ago

It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

For decades, all programs running on your computer had access to the clipboard. A primary intended purpose of the clipboard is precisely to share information between different programs. Maybe it is in fact a security issue that should be rethought, but calling it an abuse of privacy seems extreme.

ycombonator• 6 years ago

Chinese Communist Party [1] [1] https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-...

mobilio• 6 years ago

hm... seems that privacy issue: https://developer.apple.com/app-store/review/guidelines/#pri... can led to ban from AppStore

dan-robertson• 6 years ago

Fortunately for tiktok, such rules only apply to small apps. They will probably get a polite phone call from a VP asking them to please stop doing that but noting more.

riskable2• 6 years ago

Oh yes! Please! I have wild fantasies about TikTok being banned like that.

"Why was TikTok banned?"

"Because the violated the basic capitalistic principal of existing not to make money but to amass a Nazi-like ledger/database of every person in the world on behalf of a nation state."

grecy• 6 years ago

Fairly impressive if true - they must have already gobbled up tens of millions of passwords and other sensitive data that users had no idea was being stolen from their clipboard.

radomysisky• 6 years ago

To the coffers of the CCP.

dang• 6 years ago

Since you're obviously using this site primarily for ideological battle, and that's against the rules here, we've banned the account.

No, not because we're communists. Rather, this is an existential issue for HN: if we want to have a forum for curious conversation, we have to limit the amount of damage people can inflict on it in this way.

Please don't create accounts to break HN's guidelines with.

https://news.ycombinator.com/newsguidelines.html

triceratops• 6 years ago

Let's be real. Is anyone honestly surprised?

rhizome2• 6 years ago

"Surprise" is not a good standard for concern.

avh02• 6 years ago

Depends on what you're doing, driving or flying - you don't want surprises, they'd definitely be concerning. Privacy too in my opinion.

ferest• 6 years ago

running old app on new OS can cause unpredicted behavior is normal, and here is assuming it is not iOS14 bug

RandallBrown3• 6 years ago

iOS 14 added this feature (the clipboard notification) to catch this type of behavior.

It's possible that TikTok isn't doing anything and this is a bug, but it's more likely they're using the clipboard in a way they shouldn't.

harpastum• 6 years ago

It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification.

If TikTok is actually constantly loading the clipboard, that's obviously terrible. I'd bet this behavior is gone by the next release, and that shows how useful this new notification is.

Same issue with notes from that app's developer saying what's going on and how they will fix it: https://twitter.com/ecormany/status/1275903947899797505

_bxg12• 6 years ago

There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button)

People keep saying this but I've never seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing every app to be reading my clipboard at all times.

It's inexcusable to me that there isn't a permissions prompt for this. Two of my most common types copy-pasted strings are URLs and passwords.

jborichevskiy• 6 years ago

I've never seen one of these app-specific paste widgets

IIRC having an address (or address-looking string) in your clipboard will cause it to show up as the first result on the search screen in Google Maps.

pininja2• 6 years ago

Is the “Link you copied” feature in new tab of iOS google chrome one of these?

As well as the “Address you copied” iOS Google Maps search field feature?

patrickyeon8• 6 years ago

Here's an example, highlighting a band name on a festival website. Stock Chrome (and Spotify) on a stock Android on Pixel 3A https://imgur.com/a/1GqrRVs

xylophoner• 6 years ago

I use this all the time with Pocket (copy a URL somewhere, then switch to Pocket, where it asks if I want to bookmark the just copied URL).

comex• 6 years ago

People keep saying this but I've never seen one of these app-specific paste widgets.

Here’s one:

https://twitter.com/twolivesleft/status/1275776460918157315

jasonlfunk• 6 years ago

People keep saying this but I've never seen one of these app-specific paste widgets

The Google Translate app does.

masklinn3• 6 years ago

People keep saying this but I've never seen one of these app-specific paste widgets.

Both pocket and instapaper will prompt if open with a link in your clipboard.

Several reddit clients as well, I’ve seen in on narwhal and the Apollo dev explicitly noted they do that in the corresponding Reddit thread.

speedyapoc2• 6 years ago

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code.

Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

tempestn• 6 years ago

You'd think if the user knew to copy a tracking code into their clipboard, they could also paste it into the appropriate field without the app needing to extract it for them.

Edit: fair responses, all. You've convinced me.

mkenyon• 6 years ago

I mean, sure, you're technically correct, but you're missing the point. For just one example, it's so heckin' convenient when an app recognizes that you have a 2FA token in your clipboard copied from your 2FA app and "pastes" it for you automatically.

the_pwner224• 6 years ago

Not having to paste is very useful. Especially on mobile where pasting is slow and tedious.

A few months ago I would have said the same thing as you, but then I experienced some applications which looked at what I had copied and automatically did all the hard work. It's a pleasant surprise to see it happen, and having experienced it, I am happy that the applications have this functionality.

Of course if you're living in a world where all the code on your device is considered hostile, then you may not want this. But I use almost only free software and there you can generally start with a presumption of goodwill instead of starting with a feeling of distrust, like with TikTok.

jdminhbg• 6 years ago

Yes, but this is still convenient. For example, Pocket (a read-it-later service) checks your clipboard when you open the app. Normally to add a new URL to your reading list, you need to tap through a menu or two from the front page of the app. But if it detects your clipboard has a URL on it, it provides a small one-tap "Add this copied URL to your list?" button at the bottom of the screen, reducing the friction.

binarycrusader2• 6 years ago

Google/Apple maps does this too; if you've copied an address and then open them it offers you the copied address as a suggestion (usually with a clipboard icon) or as an option to navigate to instead of having to copy/paste manually.

reaperducer2• 6 years ago

I use a shipping app that does that. Doesn't the shipping app know when it's newly in focus, and shouldn't it only then check the clipboard, not constantly check?

FWIW, the one I use only checks once — upon startup. It's sometimes annoying that I have to kick it out and re-launch if I've copied a tracking URL from e-mail after the delivery tracking app is already open, but now that I know that's the price of privacy, I'm perfectly OK with it.

derimagia• 6 years ago

I know in some apps when logging in with a TOTP (2-factor auth code) it scans your clipboard for it.

I believe Slack was one of these. I thought it was useful at the time.

patrickyeon8• 6 years ago

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it."

Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input field? Is it that much to ask that you find the least offensive way to serve your user?

On the other hand, what will you lose when the news gets out that you've created a keylogger? What about when someone else at your company pushes you to monitor for something else for strategic advantages? Or what about when another developer doesn't understand the implications and now your app is responsible for revealing passwords or other sensitive information? Are all of these worth saving one click?

cbsmith2• 6 years ago

I'm not sure that looking at what a user is typing into the comment box for the application really qualifies as a significant privacy violation. That presumes a privacy model that isn't terribly intuitive or practical.

Now, if they had evidence that the data from the keyboard was being sent up to a server, that'd be a different story.

untog4• 6 years ago

Is it that much to ask that you find the least offensive way to serve your user?

Up until now there’s been no way the user has been offended because they haven’t known it’s happening. So there’s no real incentive to do it when you focus on a text field vs anything else.

And more broadly, there isn’t a downside if you use the API honestly: e.g. to check for a numeric code that matches whatever regex for one of your orders and otherwise disregard the data immediately. I’d bet a good number of users find it useful.

CGamesPlay• 6 years ago

will you lose out by only checking the clipboard when the user hits your text input field? Is it that much to ask that you find the least offensive way to serve your user?

In your toy example of my app's main screen being a text box where the user can insert a tracking code, yes, I do lose by making the user wonder every time "you know I have a tracking code why are you making me type it in?" In a more realistic example of, say, Amazon, where the "track my previous order" button is not the main screen of the app, the convenience is further increased by doing the detection automatically.

And what about non-text clipboard contents? Not every interface is a text-style document into which content can be embedded. Even "Copy URL" requires knowing that "share website" shared a URL and not a website. It doesn't make sense for images at all.

greggman36• 6 years ago

This is a OS bug not an app bug. You can't expect millions of app developers to get this right. An app should not be allowed to read the clipboard until a user chooses to "paste". That's on the OS for allowing this behavior. It's silly to think that making it possible to read the clipboard at any time that some how all millions of app developers will use it correctly even if they have no malicious intent.

GuB-42• 6 years ago

Why shouldn't apps use the API they are provided with?

It wasn't offensive to the user before iOS changed the rules. It is just a technical detail behind a small feature.

Every app can do bad things. For example, every app with a password field can use that data to crack your account on others services. You shouldn't reuse passwords but we all know that too few people follow that rule.

If you installed an app from some company, it means that you trust it to some extent and with that in mind it is reasonable to think that the issue is innocious. If you think a company wants to steal your passwords, why did you install its app in the first place? Clipboard or not, it will find a way of doing bad things.

statictype3• 6 years ago

Well, the problem is we don't know why they are using it.

That almost makes the notifications useless.

Apple puts app developers through an annoying review process. It seems like the least they could do is check with the developer on why they want that access and see if its legit or not.

Kiro• 6 years ago

You ask all the questions from a company's perspective, presuming no users want this. As a user, I absolutely prefer the convenience.

pavel_lishin• 6 years ago

Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

If I find someone digging through my mailbox, I don't start rationalizing their reasons for it - I ask them to explain themselves, and that explanation had better fucking be a good one.

speedyapoc2• 6 years ago

For sure. I am not in a position to determine whether TikTok is looking at clipboard contents for good or evil. I simply wanted to point out that there exist innocent reasons for looking at the clipboard.

cactus2093• 6 years ago

This is exactly why I am happy to see Apple cracking down more. I will grant you that this could very much be "innocent", but it's still completely unacceptable to me as a user.

And just about every PM or founder I've ever worked with seems to think like this - when given the choice between the straightforward, obvious way to do something, and some crazy, brittle, privacy-abusing hack that might improve conversion by 5%, they'll choose the latter every time. This is a perfect example of this kind of thing, "let's just check the contents of the clipboard every 2 seconds in case the user doesn't know how to paste." It might have even been born out of real complaints from a fraction of users who really can't figure out how to paste. And somewhat depressingly, in the defense of PMs it does actually seem to work sometimes and improve conversions. And all your competitors are probably doing it already anyway. So the only way to stop this crap is for the platform itself to step in.

Another example that's also fixed in iOS 14 - Apple already provides a perfectly usable share sheet for choosing a photo, where I can look through my whole phone and pick just a single photo to give to the app. But for some crazy reason, seemingly every app wants to recreate this themselves. So they require you to give them access to your entire photo album so that they can display it back to you with a marginally different design and a different color background than the default page. Now in iOS 14, Apple is giving the user an option to just pick individual photos to share anyway, and then presumably make it appear to the app that those are all the photos you have on your phone.

Two very welcome improvements IMO.

AlexandrB• 6 years ago

The mentioned photo change sounds awesome! I was not aware of this iOS 14 feature. Giving an app access to my entire photo album always seemed overly broad, especially given that photo EXIF data can give away other details like location.

thewebcount• 6 years ago

Oh man, that's awesome! I wish they'd do the same thing for contacts. There are a bunch of messaging apps that "need" access to every contact in your phone. I have 1 friend using their service, I don't want to give them access to my other contacts. So I don't use that app. But if I could restrict them to only the one contact I care about, I'd probably use them.

neilparikh• 6 years ago

A similar problem is that if you want to save a photo from an app to your album, you need to give the app access to your entire album for some reason. I'm not sure that it's because there's no API for write access only, or app developers choose not to use it, but it's really annoying (and a little worrying: what if the app accidentally deletes ones of my photos?).

skunkworker• 6 years ago

Deliveries on my iPhone does this. Though I’m pretty sure if apple opened up a API that would allow you to provide a hard coded Regex it would solve a number of privacy issues.

elwell• 6 years ago

Google Maps does this, and it saves a couple taps. If you have an address on your clipboard and then tap on the address input it will be the first suggested result.

dmonitor• 6 years ago

Chrome accesses the clipboard every time you touch the address bar to check if you have a URL to go to. Safari does the same, but without a pop up. Apple must be cheating somehow because even they know how annoying it is.

mFixman• 6 years ago

For that use case, it makes sense for an app to read the clipboard when it's in the Foreground.

I cannot think of a single good use case of a background app reading the clipboard like TikTok is doing in this link.

vxNsr• 6 years ago

Appears that a lot of third party apps are just using an older api that forces this notification to show. a lot less nefarious than it originally appears.

Seems that iOS14 offers a specific new API to check if there's something on the clipboard without actually seeing it which is what all these apps are trying to do.

RandallBrown3• 6 years ago

The API to check if the clipboard has contents has existed since iOS 10.

Starting in iOS 10, the UIPasteboard class provides properties for directly checking whether specific data types are present on a pasteboard, described in Checking for Data Types on a Pasteboard. Use these properties, rather than attempting to read pasteboard data, to avoid causing the system to needlessly attempt to fetch data before it is needed or when the data might not be present.

https://developer.apple.com/documentation/uikit/uipasteboard

cynix2• 6 years ago

That doesn’t seem to stop the app from checking for, say, string content, and getting access to a copied password.

SirensOfTitan• 6 years ago

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo

I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy.

(sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...)

alfalfasprout• 6 years ago

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

dheera4• 6 years ago

I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy.

Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly.

For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of luck and can only just choose to not use the app. On Android (by modifying the OS) you can actually send back fake IMU data to make the app think it got the permissions it wanted but really didn't. Or you can let access to your photos, but only let it see a walled garden of a few select photos.

shawnz7• 6 years ago

Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.

untog4• 6 years ago

Yes and no: they still allowed developers to do it for a very long time. I remember years ago when a social app was chastised for uploading your entire contact book to their servers without asking, because at the time there was no permission barrier for it.

In this instance, apps have been doing this for years. Apple knows this. It’s not entirely clear why they only decided to act on it now.

andrepd10• 6 years ago

No, you're really only transferring the trust onto Apple.

swiley• 6 years ago

It’s nice if you’re coming from something like windows where everything is closed and often maintained by an organization.

Coming from GNU/Linux where most things are open and community maintained it’s definitely a step backwards.

greggman36• 6 years ago

The walled garden does no such thing.

Either iOS is secure or it's not. if it's secure there is no need for the walled garden. Let me run anything and trust its security.

If it's not secure then the walled garden is security theater because it's trivial for any app to hide its true intent.

p1necone3• 6 years ago

Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.

jacobsenscott• 6 years ago

There was a time when people could run opensource software on their primary computing device, and total privacy control was available immediately, and not dolled out and taken away at the whims of their corporate overlords. Apple has done more to kill opensource, and thus eliminate privacy, than any other company in the history of computing.

musha68k2• 6 years ago

Do you know if the new ios will bring back (?) fine grain controls over microphone access? You can either give rights to an app for access or no access at all, which is really bad and IIRC through the "while using only" option in ios versions before was more respecting of customer privacy. If Apple removed granular mic controls before the current ios version, I really don't understand why.

dzhiurgis• 6 years ago

How is that Apple didn't catch TikTok doing this way way earlier to give them some sort of penalty.

WA6• 6 years ago

I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released:

1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts.

Sure, I could have a separate contacts app with "meta data", but this would break the integration of Contacts in other Apple products.

2. Photos. It is either full access or no access. For example, I don’t trust WhatsApp. I share photos through WhatsApp by opening the Photos app, tap share, share via WhatsApp. This works okay.

But generally speaking: why can’t Contacts and Photos have the same sophisticated access control system like Health? Heck, make it optional for iPhone users, but at least offer it.

DyslexicAtheist• 6 years ago

rubbish. if Apple allowed proper introspection this would have been discovered months ago and not just in the latest iOS release.

z3t4• 6 years ago

Why not give user the option to chose another app store? There could be many stores like in Ubuntu.

amelius• 6 years ago

but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy.

On Linux and BSD we've been having very good privacy features for years now.

Therefore I don't think that privacy is at the top of the list of Apple's motives.

m4rtink2• 6 years ago

So then why people can't run their hand inspected code on their iOS devices they own ? Why can't people run good privacy respecting GPLv3 licensed applications ?

The walled garden actually makes it harder to run software you and others can check to be sucure, instead you have to depend on some opaque QA somewhere in Apple to check that for you.

Not to mention you can't elect to use software that has features blocked by default for security reasons where you are sure it will not misuse them as you have audited the source (or even written it yourself!).

jedieaston• 6 years ago

1Password grabs the clipboard whenever I open the app, whether or not I'm even in a text field. Can't think of why it needs to do that..

jdxcode2• 6 years ago

my guess is that it's checking to see if it can clear the clipboard or if you copied something else

joshstrange• 6 years ago

I wonder if it so they can restore the keyboard when you copy a password? I know they could copy it at time of copy as well but just a thought.

untog4• 6 years ago

It’s for two factor auth tokens. When I fill in a password it copies my two factor code to the clipboard, then ~30 seconds later it restores the original clipboard content.

All pretty silly all things considered but I can’t think of an easier way to do things.

avianlyric2• 6 years ago

The app does a check for URLs and will offer to open the URL using its own browser if it detects one.

Reading around it looks like there are better APIs for doing this, where you can ask iOS is the clipboard contains a string matching a pattern, which actually getting access to the content.

unityByFreedom4• 6 years ago

Do these other apps do it for every keystroke? Do TikTok's competitors, other popular social media apps, do this?

mrtksn2• 6 years ago

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo

Okay, this could be simply a dynamic link library checking for a deep link in the clipboard.

Why do this? To preserve the state after install.

Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen.

The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session.

Of course, with iOS 14 the best practice would be to do this only once after the install.

just-ok2• 6 years ago

That's all well and good, but as a privacy-conscious user I still want to (a) know about it and (b) be able to control/disable it.

madeofpalk3• 6 years ago

Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!

trangon• 6 years ago

How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes?

It’s disappointing to see the lack of skepticism applied on a site like Hacker News.

pedrovhb• 6 years ago

What's a legitimate, non-nefarious reason for an app to do that?

layoutIfNeeded• 6 years ago

I can guarantee you that there are tons of apps that send your clipboard verbatim to their analytics services, because some product manager "wants to see the data".

madeofpalk3• 6 years ago

In that Reddit thread the author of a Reddit app mentions that they look at the clipboard to see if you have a Reddit link, and offer to open that page in the app (as iOS offers no better way).

On Twitter I saw a. Doing app mention they trigger the notification on every key press because they have custom ‘paste’ button that only shows when you have something copied.

robinson7d• 6 years ago

Sounds like that’s the Apollo app. It’s a pretty nice feature but I find it only seems to work for me when I open the app, so I have to force close it. There’s probably a button for it somewhere, but having one on the home page (or similar) seems like it would be equally good or better UX while also getting the users consent to read their clipboard (since they’re clicking the button).

Really nice app in general though.

blisseyGo• 6 years ago

Yep, for Apollo app, it makes sense why he does it. But for other apps like TikTok, it makes no sense. I wonder if the app also sends the clipboard data after that. Someone should look into network requests being made.

_frog• 6 years ago

For Apollo's use case there's a solution: iOS 14 adds a new API that lets you perform a pattern match against the contents of the clipboard. That way Apollo can attempt to match a Reddit link, and only actually read the clipboard if that match is successful.

BiteCode_dev• 6 years ago

"Companies just cannot be trusted with x" has been repeated and repeated for the last decades.

I think the conclusion is "Companies just cannot be trusted". At all. With anything.

We should assume guilty unless proven overthise for companies. They should go out of their way to show us their good will.

pwdisswordfish2• 6 years ago

"It seems like a ton of apps are abusing this feature:"

Honest question: Why do we need this feature?

As a user, I am happy to sacrafice whatever benefit it provides -- to end users -- to stop the abuse. Obviously the feature provides benefits to app developer personal data collectors.

OK by me to remove feature.

Cthulhu_• 6 years ago

I've never seen a "I will paste your clipboard for you" feature be used in any app, ever.

nuker• 6 years ago

It seems like a ton of apps are abusing this feature

Can they, if Background Refresh is off for the app? I allow it only for Apple apps.

scarlac2• 6 years ago

Generally, no. But there are ways for an app to stay active in the background. Some are grounds for App Store suspension. Music playing apps may stay somewhat active in the background. However, I don't know if the clipboard API will still work when an app is in the background.

wrkronmiller• 6 years ago

Why were this apps approved by the app store?

alpb• 6 years ago

I have a feeling like many of the apps are reading the clipboard on the launch because they probably act on copied text (e.g. if it's a link or a number, they can use that to show a suggested user action).

Obviously I might be wrong, but we live in times where many applications are reverse engineered and their traffic is MITM'ed all the time. I'm not sure if anyone’s sending those clipboard contents outside the device. That would be a problem.

makecheck• 6 years ago

Perhaps there should be a separate security level for “access whatever was just Copied in the last 4 seconds, if the only other action taken was to switch to the app requesting the clipboard”. Almost any app could clear that bar, since under those conditions it probably means “user grabbed something and wants to use it here”.

What is the use case for “read whatever was copied from anywhere for any reason at any time”? If there is one (e.g. full-fledged word processor maybe), that should still be a separate entitlement and require a higher bar, e.g. extensive app review.

vsareto• 6 years ago

That's probably not going to work well because people use devices at different speeds

thekyle• 6 years ago

It does make me wonder how many apps on Android also do this and go completely undetected. Hopefully Google adds something similar.

yen223• 6 years ago

In my Android 10 phone, if I copy a piece of text that looks like an address and open Google Maps, Google Maps will immediately offer the copied text as a search option. Google Maps doesn't do this if I copied, say, some random numbers.

I'm not sure how the Google Maps app can do this without snooping at my clipboard.

jankiehodgpodge• 6 years ago

I'm pretty sure that's the OS itself analysing the highlighted text and offering suggestions on which app to open it with.

dingaling• 6 years ago

Background clipboard access is already blocked on Android, except for direct entry apps such as keyboards.

Of course it's still possible to check the clipboard when the app receives focus, just like on iOS.

Ptrulli• 6 years ago

Do most of these apps mention this in their privacy terms? I would imagine it's somewhere in there, but who has the time to read all of that. This reminds me of HEY.com Apple is following suit in terms of notifying the user on privacy...

kstrauser• 6 years ago

iOS already prompts for other things like "app Foo would like to know your location: Never, Only when open, Always". Users are use to this. I'd love a popup like:

"TikTok wants to see what you've copied into your clipboard: Never, Once, Always, Uninstall that spyware".

Then I could make informed decisions, like sure, my package tracker can see if there's a FedEx URL in my clipboard. I'm OK with that. There's literally no reason why I'd ever want Instagram to check my clipboard, though. May you do, and you could give it permission.

steve_taylor• 6 years ago

It’s unbelievable that Apple would leave this security hole wide open for so long. Notifying the user is not enough.

filleduchaos6• 6 years ago

I would love to know what OS you're using that requires permissions for foreground app access to the system clipboard.

spaetzleesser3• 6 years ago

There should also be a log “App foo has used your location at these times: <list of dates>}

Sprakle• 6 years ago

They actually have this, and I think its intentionally very creepy: https://support.apple.com/library/content/dam/edam/applecare...

nojito• 6 years ago

Apple also allows you to share relative location.

A 10 square mile box.

markdog12• 6 years ago

Yeah, not just "what you've copied into your clipboard", but "Careful! Sometimes you have important confidential data in your clipboard, such as passwords!"

beervirus• 6 years ago

Why is there programmatic access to my clipboard at any time other than when I click paste?

judge20202• 6 years ago

Not every text box is a Cocoa text box, so the paste functionality might need to be handled via code.

davidajackson• 6 years ago

clipboard access should really be permissioned just like mic access etc

anticensor• 6 years ago

Real solution is to make the clipboard behave like a channel (both must be running and target must be on foreground), not like a buffer. No permission mess.

keyle• 6 years ago

It would be easy to see foul play here... But I can only imagine the size of the development team behind such app and it's probably some dumb feature commit implemented by someone who isn't there anymore that checks to insert "Tok" every time someone types "Tik".

Or some other evil purposes.

jedberg3• 6 years ago

Here is an explanation from a 3rd party reddit app developer:

tl;dr: Since Apple doesn't give a way to open URLs in 3rd party apps, he inspects the paste buffer for reddit URLs, but he aptly points out that he could read anything in the paste buffer if he wanted to:

"Hey! I make Apollo for Reddit and a few people asked me about this and if Apollo does anything with the clipboard so I wanted to answer.

Since iOS doesn't have a mechanism to open URLs in a specific third party app Apollo has a feature where if you open the app with a Reddit URL on your clipboard it'll offer to open that URL in Apollo, I think I copied this from Instapaper awhile ago. This does cause a potentially creepy looking notification with Apollo sometimes, but just wanted to explain why/what it's doing. It's literally just like "Hey iOS, is there a URL on the clipboard? Oh there is, is it a Reddit one? Okay cool let me ask them if they want to open it." Obviously at no point does anything else happen like it leaving the device or anything. It'll show this banner even if there's not a Reddit URL because it needs to check the URL to see if it's a Reddit URL in the first place. Schrodinger's Reddit URL.

But the clipboard API (prior to iOS 14) was very open, as someone else said, what if medical records were on your clipboard as text? Well in Apollo's case, that doesn't qualify it as a URL, so it wouldn't even "look". (And even for URLs, it doesn't store a list of them even on the device, it just opens it if you ask to, and then saves the most recent URL so it won't keep repeatedly prompting you if you say no.)

But that doesn't mean other apps couldn't be! They could be doing some Creepy Shit™ so I think this API change is good. It means I'll have to be more clear with Apollo doing this, and I've already had a few Apple engineers reach out with ways, but I think it's a very good change for user security."

From: https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...

unityByFreedom4• 6 years ago

We need an answer from TikTok not Apollo.

jedberg3• 6 years ago

Of course. The point is there are legit reasons for this to happen.

spaetzleesser3• 6 years ago

I think in general operating systems shouldn’t just ask the user for permissions when an app wants to do something. But they also should provide a log about when, to what extent and how often apps are using that permission. For example when I give an app permission to read message I still have no clue how often the app does it.

_jal• 6 years ago

The clipboard belongs to the user. It is quite obvious how clipboard-snooping could disclose sensitive information, and as far as writing to it, I should be able to expect the thing I copied last to be there when I hit paste next.

I'd be in favor of banning application-initiated access entirely. I realize this would interfere with 1PW and similar. That was always a hack, and the fact that so many apps snoop on the clipboard is a great reason for it to stop! Sensitive dataflows for things like passwords need far better protection.

nullc• 6 years ago

I was shocked to find out that firefox enabled websites to access the clipboard sometime in the last five years or so. .. and I'm left stressed out that I could have had important passwords or key stolen this way.

This can be disabled by setting a preference: https://www.ghacks.net/2014/01/08/block-websites-reading-mod...

lucasmullens• 6 years ago

Firefox prompts for your permission to read from the clipboard: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

But I'm not sure if that's always been the case.

gruez2• 6 years ago

that's for addons, not websites

gruez2• 6 years ago

I don't think that site's accurate. I searched around and there seems to be two ways of reading clipboard contents: making a fake dom element and waiting for the user to paste, or to use the async clipboard api. The first doesn't seem abusable because it requires you to actually paste something. The second doesn't seem to be supported by firefox, at least according to this demo: https://googlechrome.github.io/samples/async-clipboard/.

PatrolX• 6 years ago

Here's a test you should run.

Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is.

Copy that bitly link to your clipboard and repeat what you're doing in that video.

Monitor the bitly link for clicks.

Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits and keep a record of the IP addresses.

zerd• 6 years ago

You can also use something like requestbin/postbin to capture the whole requests and see IPs, headers etc.

xvector6• 6 years ago

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem.

I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance.

I wish they just cut the bullshit and fixed these holes though, they've been around for years. It's really depressing to see Apple's fantastic security work in other parts of the stack be completely and utterly compromised by OS design decisions like this.

greggman36• 6 years ago

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

edoloughlin• 6 years ago

wonder if Apple is playing 4D chess here though

Why 4D? Isn't chess just a 2D game with wormholes?

on_and_off• 6 years ago

I wonder if Apple is playing 4D chess here though

Ockham's razor says that they just don't care enough about this.

coronadisaster2• 6 years ago

I did that many years ago but with email... I sent a secret link from and to a microft email address and it was then accessed by a microsoft bot...

skim_milk• 6 years ago

Of course, they inspect received/sent email for spam/antivirus purposes

fouc• 6 years ago

I hope someone does this and reports the results

Lt_Riza_Hawkeye• 6 years ago

[canarytokens](https://canarytokens.org/generate) are built for this, though I wouldn't use them for anything long-running

chrsstrm3• 6 years ago

It's even easier than that, just use ngrok. I recorded a demo video of a web interface running locally via ngrok. Left the tunnel up while the video uploaded to YouTube so I could send it privately to a colleague and during processing I started to see requests on my tunnel. YT scraped the URL from the video and was requesting it one char at a time until the entire address was complete. IIRC this was almost two years ago. That was also the day I decided no more visible private links in YT videos.

samanator2• 6 years ago

That's wild! What do you mean they were requesting it one character at a time? The URL itself? If so,how do you know that? Do you also own urls in that "character space" leading up to your URL?

aasasd• 6 years ago

While you're at it, you can try opening your page in Chrome and watching the log afterwards.

Dunno is the ‘feature’ is still there, it was over five years ago.

INTPenis• 6 years ago

I was in a situation like this once recently. I was trying to send a password pusher link to my brother over Signal. The password pusher was set to expire after 1 day or 1 view. And my brother kept saying the link didn't work.

Of course it doesn't work when Signal fetches it before him to make a preview!

Had to set it to exactly 2 views and then he could view the password.

And iirc the Signal-desktop release for Linux I was using could not disable previews of links. And even if it could, his end might have previewed it.

lixtra• 6 years ago

The password should have been shown after a POST request, not to a simple GET request.

Put a button “click her to see password, you got one chance” to trigger the POST.

giancarlostoro• 6 years ago

I wonder what this sort of spam does to your battery life. This really should be a permission configuration.

statictype3• 6 years ago

Whats the point of having an App Store as the gatekeeper for installing apps if you aren’t going to catch this shit?

CardenB• 6 years ago

I believe iOS14 has features to detect this: https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches...

statictype3• 6 years ago

Yes - I mean why hasn't the App Store review process already caught this in previous versions of iOS? Why do we need to wait for the technical capability to be surfaced to users?

How are we supposed to know if the app's continuous request for clipboard access is ok or not?

I feel like that was literally the only value-add in the App Store review process and the fact that its a feature in iOS seems to indicate that Apple is throwing in the towel here and saying "we don't know if this is a privacy issue or not so we will just notify you about it".

deadbacon• 6 years ago

Lyft is doing the same thing. But it seems the frequency is lower compared to TikTok

guug3• 6 years ago

People were saying the Google Maps also does it.

OldHand2018• 6 years ago

In the coming days I feel as if we are going to see a lot more threads about the new privacy features in iOS 14. Apple has a video overview of a lot of the new stuff [1]. I suggest watching it (at 2x speed - they talk very slowly). Especially at 16:30 where they emphasize that SDKs are part of your app and that you the developer are fully responsible for the data collection of any SDK you include in your app. This is going to be a huge problem for a lot of developers.

[1] https://developer.apple.com/videos/play/wwdc2020/10676/

drevil-v2• 6 years ago

If by problem you mean end of laziness then sure. You can no longer drag and drop FB or google analytics SDK into your project, type in a few lines of glue code, email the product owner that you have added tracking capability into the app and head down to the pub to spend some of that well earned six figure developer salary.

Now I am gleeful about this because it's win-win for me as a consumer and software engineer. Better privacy and use of my data as a consumer. More $$ work as an engineer when all those analytic pipelines need to be re-architected and rebuilt.

askafriend• 6 years ago

This is going to be a huge problem for a lot of developers.

The way I see it, it's not a problem it's a responsibility. The problem was the lack of responsibility in the first place.

aneutron• 6 years ago

That's it. I'm switching to iOS. Android is like child's play when it comes to privacy compared to the features introduced just in this version of iOS. I'm sure I'll hate the lack of customizability but at least the privacy features are solid.

product50• 6 years ago

This is the problem with Chinese apps. You just can't rely on them. They simply don't have the same principles of privacy like US companies do. Even Facebook won't do something like this.

filleduchaos6• 6 years ago

Plenty of US companies build apps that do the exact same thing (checking your clipboard).

xbar• 6 years ago

Do you like TikTok reading your clipboard?

llacb47• 6 years ago

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere.

Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this:

https://github.com/llacb47/mischosts/blob/master/tiktok-host...

throw03172019• 6 years ago

Wow...I can’t imagine managing all of those.

xvector6• 6 years ago

Genuine question, why don't companies proxy tracker data through a single host that the app also depends on to serve data?

That way it wouldn't be possible for users to block individual hosts to prevent tracking. I guess it's not worth the effort though because laypeople won't care either way?

cleverpebble• 6 years ago

Most trackers are 3rd parties that require you to go through their hosts. Additionally, these trackers are usually picked out by business analysts / product managers on different teams - so marketing my have their own tracking solution, sales might have their own, and engineering might have their own. Tends to be faster/easier to plop javascript on a page than engineering your own tracking/analytics pipeline at early stage startups

gitgud• 6 years ago

They aren't proxy'd because advertisers want to ensure they control the domain and can verify requests are going to it, without having to trust the content provider.

Some content providers don't allow you to view content if you block the advertising hosts.

Then it becomes a matter how you want to deal with failure, do you want the site to break if your ads don't load?

ogre_codes4• 6 years ago

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere.

Maybe you just didn't copy anything TikTok was interested in keeping track of. I can think of a lot of really obnoxious things you can do with clipboard data, everything from scanning the contents to collect interests, scanning for URLs, collecting information about what applications are installed. A lot of this could be analyzed on device and it would only update infrequently.

masklinn3• 6 years ago

Maybe you just didn't copy anything TikTok was interested in keeping track of.

Odds are, like almost every other application it cares about website URLs to deep-link. Pretty much every reddit client does that for instance.

antpls• 6 years ago

If I had to design it, I would not directly send the data to the central server. I would first store it for a period of time, then compress everything and then send it while the phone is inactive and plugged to the sector. Or I would build a model with the data on the phone, then send that to the central server. Both ways would be asynchronous.

MintelIE• 6 years ago

We can expect every security hole possible to be exploited by these Chinese military apps. Heck, Fortnite intalls a rootkit on your PC for "anti-cheat" and that's even more egregious, yet it is allowed. The situation on Android is probably worse, most apps request access to everything these days and users are afraid to say "no" because of fear of breakage.

bigphishy2• 6 years ago

Fu*king A... uh maybe we need to make Open Source required by law... just anything but this.

WE as society cannot allow this impunity that is occurring by a very well powerful corporation, a nation-state sponsored Corporation, no less. Where does it end? Why do we allow this to occur? Why do members of our own society not know the perils of using this technology?

opan• 6 years ago

Finally someone tackles the real issue here. You can't trust proprietary software, no matter which country or company is behind it. Aim for free software instead of putting your trust in a company's black box.

bigphishy2• 6 years ago

As society cannot allow this impunity of powerful corporations, a nation-state sponsored Corporation in this case.

Why do members of our own society not know the negative effects of using this technology?

jasonlingx2• 6 years ago

I use Bitwarden on my iPhone and sometimes copy passwords to the clipboard for some reason. Does this mean any app could have snooped on it without me knowing before?

scarlac2• 6 years ago

Yes, that's probably part of the reason why 1Password clears the clipboard after a minute or so

jasonlingx2• 6 years ago

That’s crazy. IOS prompts before giving apps your location, clipboard data is many times more sensitive

austincheney• 6 years ago

TikTok users seem to be incredibly young, like children, so I doubt they care their privacy is violated.

hilyen• 6 years ago

This is unacceptable.

navinsylvester• 6 years ago

Chinese investment money is everywhere so they try to control the narrative. I have seen for sometime that on HN, we are open to criticize but don't take a standpoint unless its something to do with western government.

I think this is due to the flame war or rating system of HN, where active discussions are relegated to oblivion. Instead of trusting biased and funded media - we here need to introspect, without us being silenced.

May be we are mostly left so we don't have a much stronger opinion unless its right - is that the case?. Just curious - why the slack?.

Abishek_Muthian• 6 years ago

Apps abusing clipboard can steal the passwords from the password managers when user copies it and associate with the user account via parallel construction.

e.g. Time of stealing password from clipboard + time of my HN comment.

I've been long weary of this, android 10 has made some changes like allowing only IME & in-focus apps to access the clipboard. Not a fool-proof way to prevent the issue.

One more reason to destroy app duopoly, switch to pure Linux OS [1][2][3] and force app publishers to stick with web apps/PWA with more user control.

[1]https://store.pine64.org/product/pinephone-community-edition...

[2]https://postmarketos.org/blog/2020/06/15/pinephone-postmarke...

[3]https://puri.sm/products/librem-5/

brianush1• 6 years ago

Apps can still read the clipboard at any time they want on Linux. A pure Linux OS is definitely better, but for other reasons.

jayp1418• 6 years ago

At least signal messenger doesn't do this behaviour. Still keep incognito keyboard turned on from settings for extra protection:

https://community.signalusers.org/t/ios-14-catches-apps-spyi...

etaioinshrdlu• 6 years ago

Yet another reason web apps are generally better for security than native!

ed25519FUUU• 6 years ago

This is actually a big reason why I always prefer to use the mobile site instead of the app. The modern browser treats the web much more as an “unsafe” place. Not to mention I prefer standard ways to do things like “go back”. Plus you get Adblock.

ogre_codes4• 6 years ago

I'm certain Apple knew in advance that a fair number of apps would trip this up and which ones were going to run into issues in advance. It's interesting that they went ahead and turned this on immediately without warning developers it was coming. Perhaps they wanted people to see what they were preventing.

xsmasher2• 6 years ago

This is in a beta of iOS14. It's expected to have changes, sometimes breaking changes.

This is the beta process working exactly as it should.

hanspeter• 6 years ago

what they were preventing.

You could also look at it as _what they had offered apps unlimited access to in the previous 13 OS versions_.

lxe• 6 years ago

Is this really news? Google maps suggests to navigate to an address you copied to the clipboard. No app should have permissions to access the clipboard without you explicitly selecting 'paste'

andrewPP• 6 years ago

It might be that an API that many of these apps use is using this feature.

jwiley• 6 years ago

It seems like this is nothing new:

https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-ap...

gorgoiler2• 6 years ago

Can one app copy data into the clipboard and then another app paste it out?

They could even collude behind the scenes, once they’ve communicated over the clipboard as a channel to establish a link, to replace the original data in the clipboEOF[CITIZEN:8EF7720=FLAGGED]

willhay• 6 years ago

Crazy thing is that I would open TikTok on my phone and occasionally see a loading dialog that said "Pasting Clipboard" (from MacBook Pro). I finally freaked back in March and Googled it and found this... https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-ap...

maartn• 6 years ago

It’s a shame that this turned into a discussion about iOS. It’s still the burglar that’s faulty, not the homeowner that leaves a window open

rurban• 6 years ago

This needs legislation. Apps should not be allowed to inspect foreign private content if they don't manage it. Only a few apps would need that.

That new technical solution in the beta certainly comes handy, but legislation is better.

coronadisaster2• 6 years ago

LoL... Why doesnt it block it in addition to revealing it? I don't think that it would break any features that I want to use.

pdimitar2• 6 years ago

I applaud Apple for the continued privacy efforts, including finer-grained Photos access (linked by another poster in this thread: https://appleinsider.com/articles/20/06/24/apple-fine-tunes-...).

But at the same I can't help but be bitter. The smartphone scene is very active ever since, I don't know, 2011? All the companies and shady information dealers have gathered mountains of private information.

Is this not too little, too late? This would have been welcome at the iPhone 5 release. Nowadays I wonder what difference would these measures even make.

Majestic121• 6 years ago

It is steps in the good directions, and as far as I know they are way more advanced than Android on this point.

Those features would have been welcome a few years ago, that's for sure, but let's not blame them now that they do what's right.

What's out there is already out there, you're right, but we can hope that those shady information dealers will have much more trouble in the future.

pdimitar2• 6 years ago

It is steps in the good directions, and as far as I know they are way more advanced than Android on this point.

I have the same impression. Which is saddening because I thought of going back part-time to Android and experiment with homelab builds and p2p architecture with a few spare Android devices. But I am not comfortable with how much and lower-level Google and the phone's vendor have and I am sure that no matter how I secure an app with access to photos/contacts/etc. then the kernel could likely still extract the info it needs... Don't know, but I am quite paranoid about smartphones lately.

let's not blame them now that they do what's right.

Agreed. Better late than never. I simply feel that marketing trumps privacy concerns here. Apple wants to have what to brag about every year so features that should come once every 2-3 months are coming annually instead.

ngold• 6 years ago

Why is this still on their store? I assume it breaks their walled garden approach. It seems Apple is putting kids at risk, in fact it looks like kids are having their privacy actively abused.

waltpad• 6 years ago

I wonder how the clipboard API could be fixed.

I suppose that the current scheme is that apps are monitoring paste events, and when it happens have a look at the clipboard for copied data.

Perhaps the clipboard shouldn't be visible at all, and only when the user decides to paste content should the targeted app receive a "paste" message with the copied data (or perhaps some more complicated selection mechanism with a list of recent copies à la emacs). This would essentially merge the 2 steps process outlined above into a single operation.

It's probably more complicated than that though.

wslh• 6 years ago

I think we should have some kind of "clipboard firewall" where you can restrict if a clipboard copy operation in an app X could be pasted in app Y.

We have developed a free Windows app and will release it soon.

dana321• 6 years ago

It also revealed to me that that Dropbox was tracking my location in the background while i was traveling on a train..

itsbits• 6 years ago

Apple is fine with this but have a problem with hey.com's own charging structure!!!

uptown• 6 years ago

I've been trying to bring the clipboard privacy issue to people's attention for awhile.

https://news.ycombinator.com/item?id=21383241

Happy to see it's going mainstream. I'm hopeful that iOS 14 will provide a way to limit this behavior on a per-app basis.

teekert• 6 years ago

My bank (bunq) offers me to pay the iban (european bank account number) as soon as I open the app with an iban on te clipboard. That's the same, isn't it?

giarc• 6 years ago

In the twitter video Tik Tok is pasting from Instagram though. I also don't know why Tik Tok would be looking for text on the clipboard (to be fair I've never used Tik Tok though).

dreamcompiler• 6 years ago

TikTok is known to be Chinese malware. Is anybody on HN surprised by this?

https://www.military.com/daily-news/2019/12/30/army-follows-...

kpennell• 6 years ago

I know this and I get it....but damn it's so much more entertaining than Instagram now. The content is more varied, more raw, and the for you page filtering is so well-tailored.

kinnth• 6 years ago

Is it even clear whether this data is being sent back to Tiktok or any company or is it simply to check for activating keywords to add app functionality?

Is it all done locally?

BFatts• 6 years ago

I find it interesting that people automatically assume nefarious reasons for accessing the clipboard... If your privacy is so important, don't use platforms you cannot trust. If that means not using a smart phone, then maybe you will do something positive for yourself.

andy_ppp3• 6 years ago

Is there any logical reason to do this apart from harvesting things people have copied. Seems purely evil to me?

feelix• 6 years ago

if only they'd do this for apps accessing the microphone, or do the same thing as they do with the camera making the application visibly request access

ipiz0618• 6 years ago

Zoom, WeChat, Weibo has all been exposed of sending users' data back to Chinese servers. Why would TikTok be different? It's already alarming enough that a Chinese social media app is at the top of the App Store.

People need to learn to stop trusting these apps.

nerdjon• 6 years ago

Woke up this morning thinking...

There is a part of me that is little sad Apple did not just wait to add this feature until iOS 14 released or one of the last GM's.

If only because it would be a huge wakeup call for users about what their apps are doing and possibly collecting, instead of it all being patched out now. Instead we are seeing basically no traction on this outside of tech circles.

vecio• 6 years ago

TikTok and many popular Chinese apps, including Taobao, Baidu, and Alipay, to name a few, snoop clipboard contents, because Tencent censors and forbids almost all kind of links sharing in WeChat and QQ.

https://news.ycombinator.com/item?id=23654345

NN88• 6 years ago

Apple is really setting the tone.

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

Related Stories