3 ms·

I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years. It reminds

I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years. It reminds me of the phenomenon when researchers and engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool. The security team is so busy dealing with absurd edge cases like nation-states attacking your enclave that they don't seem to care to address egregious and obvious holes in the security model like this. It's not that WebAuthn and passwordless isn't exciting or useful, it's just that there are much bigger fish to fry (clipboard paste, terrible permissions management, non-shitty VPN support, trackers in apps) that Apple seems completely uninterested in addressing. There really is no excuse, at least not when you're tooting the privacy/security horn so loudly, but let stuff like this pass by. Edit: have y'all thought of an actual counterargument instead of just downvoting? Is it really too much to ask security engineers at Apple to focus on actual major privacy holes in their OS than things like this?

_fzslm 6y ago
i don't want to focus too much on why i think you're being downvoted but i would say it's probably because your message came across as quite reductive. > engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool i get this, to some extent. i really do. but i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators, etc. are not huge steps forward in terms of mobile privacy & security. (rough double negative. you get me.) i am pretty sure Apple knows about everything you stated, and would wager they are developing, or at least R&D'ing, effective, polished, "Apple" solutions to these problems. clipboard is a bit of an obscure one, but is absolutely a problem and must be addressed. but Apple is in the business of juggling user experience and privacy. it's quite difficult, because you don't want to get in the way of the user's intents and make things way hard to do. but you also don't want to make things so easy that bad actors can get away with bloody murder. granted, they still can, if they really want, but it's way harder. and slowly apple is killing the mice. it's a cat and mouse game. i think they're doing exactly what they should be. could they be doing more? hell yes. they should -always- strive to do more. but right now, this is better than last year, and the year before that, and the year... yknow.
- xvector 6y ago
  > i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators, etc. are not huge steps forward in terms of mobile privacy & security. For sure, but they are far less needed than the described issues. You see, the problem is that these holes have existed in iOS for a long time and affect the practical security of the everyday users. WebAuthn is definitely the future of the web, but why can't we fix the giant holes in the ground before building upon it? This goes back to the problem of researchers focusing on things that are exciting and will be the future, but not focusing on the needs of the everyday customer. This was the downfall of RCA back in the day. > Apple is in the business of juggling user experience and privacy. it's quite difficult, because you don't want to get in the way of the user's intents I understand this struggle. Still, most users are horrified when they learn that everything they've ever copied has been shared with the apps they are using. Even the layperson would gladly give up some trivial auto-paste feature if they knew this. I would understand Apple's slowness to respond if this was a recent issue, a newly-discovered hole in privacy. But this is a big thing. It's been around for years. And many others have too. Apple has engineers, they have PMs, and those engineers and PMs are working in the same problem space with these holes. But new features that won't matter for years are being prioritized over major issues that have existed for years, and that's not cool, not when you are yelling that you care about privacy from a mountaintop.
loljabab 6y ago
They just pushed clipboard usage detection as a feature in the new iOS... I think this addresses pasteboard concerns in a decent way, no?
- xvector 6y ago
  Not at all. Detection doesn't stop the compromise once it has occurred. And given that many major apps use this functionality, it's not like users can really do anything about it even if they get that notification.

_fzslm 6y ago

i don't want to focus too much on why i think you're being downvoted but i would say it's probably because your message came across as quite reductive. > engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool i get this, to some extent. i really do. but i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators, etc. are not huge steps forward in terms of mobile privacy & security. (rough double negative. you get me.) i am pretty sure Apple knows about everything you stated, and would wager they are developing, or at least R&D'ing, effective, polished, "Apple" solutions to these problems. clipboard is a bit of an obscure one, but is absolutely a problem and must be addressed. but Apple is in the business of juggling user experience and privacy. it's quite difficult, because you don't want to get in the way of the user's intents and make things way hard to do. but you also don't want to make things so easy that bad actors can get away with bloody murder. granted, they still can, if they really want, but it's way harder. and slowly apple is killing the mice. it's a cat and mouse game. i think they're doing exactly what they should be. could they be doing more? hell yes. they should -always- strive to do more. but right now, this is better than last year, and the year before that, and the year... yknow.

xvector 6y ago
> i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators, etc. are not huge steps forward in terms of mobile privacy & security. For sure, but they are far less needed than the described issues. You see, the problem is that these holes have existed in iOS for a long time and affect the practical security of the everyday users. WebAuthn is definitely the future of the web, but why can't we fix the giant holes in the ground before building upon it? This goes back to the problem of researchers focusing on things that are exciting and will be the future, but not focusing on the needs of the everyday customer. This was the downfall of RCA back in the day. > Apple is in the business of juggling user experience and privacy. it's quite difficult, because you don't want to get in the way of the user's intents I understand this struggle. Still, most users are horrified when they learn that everything they've ever copied has been shared with the apps they are using. Even the layperson would gladly give up some trivial auto-paste feature if they knew this. I would understand Apple's slowness to respond if this was a recent issue, a newly-discovered hole in privacy. But this is a big thing. It's been around for years. And many others have too. Apple has engineers, they have PMs, and those engineers and PMs are working in the same problem space with these holes. But new features that won't matter for years are being prioritized over major issues that have existed for years, and that's not cool, not when you are yelling that you care about privacy from a mountaintop.

loljabab 6y ago

They just pushed clipboard usage detection as a feature in the new iOS... I think this addresses pasteboard concerns in a decent way, no?

xvector 6y ago
Not at all. Detection doesn't stop the compromise once it has occurred. And given that many major apps use this functionality, it's not like users can really do anything about it even if they get that notification.