31 ms·

iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes

1847 points by georgespencer 6y ago

gentleman11 6y ago
I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin. I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?
- riskable 6y ago
  The problem is that iOS doesn't differentiate between a call that merely checks for the presence of a clipboard entry (e.g. so you can enable "Paste" in a menu/submenu) and actually copying the contents of the clipboard. The workaround (for legitimate apps) is to simply always keep that "Paste" option enabled--even if the clipboard is empty. That way you won't freak out your users and only suffer the most minor of usability consequences. Having said that I don't think TikTok has any relevant functionality such as enabling a "Paste" option so... Most likely nefarious!
  - selsta 6y ago
    iOS differentiates between this since iOS 10: https://developer.apple.com/documentation/uikit/uipasteboard/1829416-hasstrings https://developer.apple.com/documentation/uikit/uipasteboard... Also iOS 14 has new clipboard related APIs to further check the content without actually accessing it.
    - BoorishBears 6y ago
      If iOS 14 adds new APIs to check, then I wouldn't be surprised if the codepath hasStrings uses triggers the warning The purpose of hasStrings was performance not indicating intent, so that wouldn't be surprising
  - pininja 6y ago
    > I don't think TikTok has any relevant functionality Does pasting text into a video as an annotation require “Paste” to be enabled in this way?
    - ladberg 6y ago
      I believe any time you paste with the native keyboard UI up it doesn't go through the app. You only need to snoop the clipboard if you want to proactively use the data without having the user paste.
- WrtCdEvrydy 6y ago
  this is weird, you usually can't past data from clipboard (part of the browser sandbox). copying into the clipboard is free, pasting is not. Edit: This seems to be the app TikTok, not a website.
- moonchild 6y ago
  It is a risk. There's an easier solution, though. about:config -> dom.event.clipboardevents.enabled=false
- ciarannolan 6y ago
  A Yubikey or similar device is a good way to mitigate the damage of having your password manager's password stolen. https://bitwarden.com/help/article/setup-two-step-login-yubikey/ https://bitwarden.com/help/article/setup-two-step-login-yubi...
  - rvz 6y ago
    And for macOS users, Touch ID takes this further without any devices, dongles or passwords, which 1Password, Dashlane, etc already supports.
    - ciarannolan 6y ago
      It seems to me that Touch ID is slightly less secure, given that it stores your fingerprint on the device and you rely on the Apple module and crypto to be implemented securely. With a Yubikey, the only thing you have to do to stay secure is to not lose it or let others use it.
      - judge2020 6y ago
        The attack surface is larger but it's still not an attack almost anyone needs to worry about - a 0 day on the T2 (which has never been publicly found/reported on) is something only worthy of nation state attacks on other nation states.
- sgloutnikov 6y ago
  For this reason, I switched to using a PIN for Bitwarden in the browser plugin. I don't have to use my master password every time.
- nmaggioni 6y ago
  I had the same exact concern, and I haven't been able to find reliable confirmations on this being completely impossible either. It's easily testable, though, that a webpage that isn't focused (because an extension's pane is open) doesn't receive input events. Likewise, Chrome [1] and Firefox [2] extensions themselves cannot bind to relevant keys for example. All in all I would say that going through an empty tab is unnecessary - even though I got into the habit of doing it as well - and even if this wasn't true 2FA should be enough to thwart most malicious actors. [1]: https://developer.chrome.com/extensions/commands https://developer.chrome.com/extensions/commands [2]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/commands#Shortcut_values https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
  - odensc 6y ago
    Well, you probably couldn't find any confirmation because nothing in the security world is completely impossible :) Webpages aren't supposed to be able to receive input events when the extension popup is open, but there could still be an unknown vulnerability in Chrome/Firefox. So if you care enough it's best to mitigate that risk by using the standalone application for your password manager, or better yet use a completely separate device like your phone!
- odensc 6y ago
  On Chrome at least, Bitwarden has it's own extension popup window with the vault. This is a completely separate web context. There's no way for the open website to detect your keystrokes barring a vulnerability in Chrome itself. If you really want to be safe, you should use the standalone desktop apps and skip the browser extension altogether. Doing that empty tab thing probably doesn't protect you from anything.
- neetodavid 6y ago
  I took a short look at this and it appears to be a work in progress that varies between browsers... Chrome implements a "clipboard-read" permission that can be requested by calling navigator.clipboard.read(). When a page calls that it will display a permission request dialog (like those asking for permission to show notifications on seemingly every single news web page). A little clipboard icon will also appear in the nav bar showing the status of the permission (visible after a read attempt is made during that visit) Firefox is apparently on track as well, although for now the clipboard.read function is not implemented for pages and can only be called by extensions. I'm not sure what the permission dialog for extensions is like. https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A... So... it may be safe. But it is a work in progress and each browser is different. I've only checked the most well-documented method for reading the clipboard... maybe there is some other half-implemented feature or event listener that happens to leak some clipboard data...
_6fmb 6y ago
Hopefully we can turn this off, this is going to destroy usability be very annoying.
- adamhearn 6y ago
  You mean so you can snoop from the user without being detected?
  - _6fmb 6y ago
    There are a lot of valid usecases for clipboard saving, I don't have an iOS app but I run CopyClip which would be kinda ruined by this "feature".
    - remmargorp64 6y ago
      Then there should be a setting that has to be manually approved to allow the clipboard interactivity feature. I use a password manager on my iPhone and I am copying and pasting my passwords all the time. If some random app is scraping my clipboard silently and sending the data to a third party, that means my passwords are compromised. I am very much NOT OK WITH THIS. Keep in mind, this permission should be fundamentally different than the permissions for just manually copying and pasting. I don't want to have to deal with permissions to "allow clipboard use" that I have to approve every time I want to paste something. That would be obnoxious. I am only worried about restricting permissions for invisible passive snooping.
- xsmasher 6y ago
  The developer can fix it by either (1) querying "is there clipboard content?" instead of copying it every few keystrokes or (2) stop altogether if there is no legit purpose. It sounds like this feature is working as intended - closing was was a silent security risk.
beamatronic 6y ago
Why does any app have access to the clipboard? Seems like a big security hole.
- csa 6y ago
  In order to know when you should enable the paste option. It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.
  - landryraccoon 6y ago
    Couldn't IOS just have a peek API that tells the application if the clipboard is empty or not without revealing it's contents?
    - RandallBrown 6y ago
      They've had one for several years. https://developer.apple.com/documentation/uikit/uipasteboard/1829416-hasstrings https://developer.apple.com/documentation/uikit/uipasteboard...
    - deleted 6y ago
      [deleted]
  - m0xte 6y ago
    Perhaps the destination should define whether or not you can paste into it and the OS can provide that option instead. This looks like a violation of “tell, don’t ask”.
  - beamatronic 6y ago
    I should be able to paste into specific GUI elements that allow pasting. The application presenting the GUI element to me should be blind to whether I typed that data, or pasted it into there.
  - creato 6y ago
    > It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy. For decades, all programs running on your computer had access to the clipboard. A primary intended purpose of the clipboard is precisely to share information between different programs. Maybe it is in fact a security issue that should be rethought, but calling it an abuse of privacy seems extreme.
ycombonator 6y ago
Chinese Communist Party [1] [1] https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-china-national-security-investigation https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-...
mobilio 6y ago
hm... seems that privacy issue: https://developer.apple.com/app-store/review/guidelines/#privacy https://developer.apple.com/app-store/review/guidelines/#pri... can led to ban from AppStore
- dan-robertson 6y ago
  Fortunately for tiktok, such rules only apply to small apps. They will probably get a polite phone call from a VP asking them to please stop doing that but noting more.
- riskable 6y ago
  Oh yes! Please! I have wild fantasies about TikTok being banned like that. "Why was TikTok banned?" "Because the violated the basic capitalistic principal of existing not to make money but to amass a Nazi-like ledger/database of every person in the world on behalf of a nation state."
grecy 6y ago
Fairly impressive if true - they must have already gobbled up tens of millions of passwords and other sensitive data that users had no idea was being stolen from their clipboard.
- radomysisky 6y ago
  To the coffers of the CCP.
  - dang 6y ago
    Since you're obviously using this site primarily for ideological battle, and that's against the rules here, we've banned the account. No, not because we're communists. Rather, this is an existential issue for HN: if we want to have a forum for curious conversation, we have to limit the amount of damage people can inflict on it in this way. Please don't create accounts to break HN's guidelines with. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
triceratops 6y ago
Let's be real. Is anyone honestly surprised?
- rhizome 6y ago
  "Surprise" is not a good standard for concern.
  - avh02 6y ago
    Depends on what you're doing, driving or flying - you don't want surprises, they'd definitely be concerning. Privacy too in my opinion.
    - rhizome 6y ago
      You're driving along and get t-boned by a semi. Someone says, "I don't know why anybody's surprised, the crash happened at an intersection where two roads cross perpendicularly, and vehicles are traveling on those roads," are you going to nod at their profound observation?
ferest 6y ago
running old app on new OS can cause unpredicted behavior is normal, and here is assuming it is not iOS14 bug
- RandallBrown 6y ago
  iOS 14 added this feature (the clipboard notification) to catch this type of behavior. It's possible that TikTok isn't doing anything and this is a bug, but it's more likely they're using the clipboard in a way they shouldn't.
harpastum 6y ago
It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification. If TikTok is actually constantly loading the clipboard, that's obviously terrible. I'd bet this behavior is gone by the next release, and that shows how useful this new notification is. Same issue with notes from that app's developer saying what's going on and how they will fix it: https://twitter.com/ecormany/status/1275903947899797505 https://twitter.com/ecormany/status/1275903947899797505
- _bxg1 6y ago
  > There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button) People keep saying this but I've never seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing every app to be reading my clipboard at all times. It's inexcusable to me that there isn't a permissions prompt for this. Two of my most common types copy-pasted strings are URLs and passwords.
  - jborichevskiy 6y ago
    > I've never seen one of these app-specific paste widgets IIRC having an address (or address-looking string) in your clipboard will cause it to show up as the first result on the search screen in Google Maps.
    - guug 6y ago
      So google also sends the contents of my clipboard to their servers when I use their app? Wonderful.
      - xvector 6y ago
        I can't imagine being one of the PMs/higher-ups that decided to allow clipboard content to be shared willy-nilly like this. Like, what must be going through their minds when they make decisions like this? "User experience at all costs?" Seems contrary to their stance on privacy.
speedyapoc 6y ago
I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.
- radomysisky 6y ago
  Should we still be giving the benefit of the doubt to a Chinese-owned honeypot in 2020?
  - sgjohnson 6y ago
    Absolutely not.
- tempestn 6y ago
  You'd think if the user knew to copy a tracking code into their clipboard, they could also paste it into the appropriate field without the app needing to extract it for them. Edit: fair responses, all. You've convinced me.
  - mkenyon 6y ago
    I mean, sure, you're technically correct, but you're missing the point. For just one example, it's so heckin' convenient when an app recognizes that you have a 2FA token in your clipboard copied from your 2FA app and "pastes" it for you automatically.
  - the_pwner224 6y ago
    Not having to paste is very useful. Especially on mobile where pasting is slow and tedious. A few months ago I would have said the same thing as you, but then I experienced some applications which looked at what I had copied and automatically did all the hard work. It's a pleasant surprise to see it happen, and having experienced it, I am happy that the applications have this functionality. Of course if you're living in a world where all the code on your device is considered hostile, then you may not want this. But I use almost only free software and there you can generally start with a presumption of goodwill instead of starting with a feeling of distrust, like with TikTok.
vxNsr 6y ago
Appears that a lot of third party apps are just using an older api that forces this notification to show. a lot less nefarious than it originally appears. Seems that iOS14 offers a specific new API to check if there's something on the clipboard without actually seeing it which is what all these apps are trying to do.
- RandallBrown 6y ago
  The API to check if the clipboard has contents has existed since iOS 10. > Starting in iOS 10, the UIPasteboard class provides properties for directly checking whether specific data types are present on a pasteboard, described in Checking for Data Types on a Pasteboard. Use these properties, rather than attempting to read pasteboard data, to avoid causing the system to needlessly attempt to fetch data before it is needed or when the data might not be present. https://developer.apple.com/documentation/uikit/uipasteboard https://developer.apple.com/documentation/uikit/uipasteboard
  - cynix 6y ago
    That doesn’t seem to stop the app from checking for, say, string content, and getting access to a copied password.
SirensOfTitan 6y ago
It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/ https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...)
- alfalfasprout 6y ago
  People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.
  - dheera 6y ago
    I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy. Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly. For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of luck and can only just choose to not use the app. On Android (by modifying the OS) you can actually send back fake IMU data to make the app think it got the permissions it wanted but really didn't. Or you can let access to your photos, but only let it see a walled garden of a few select photos.
    - Skunkleton 6y ago
      You're right, but you are also missing the point. Consumers in general have access to one of only a few options for computing tasks. To date, of these mainstream options, only Apple is taking a meaningful stance on privacy. Is it self-serving, sub-optimal, or otherwise broken? Probably. Is it the best thing for privacy currently widely available? Probably.
hkt 6y ago
I note with interest some commenters with.. interesting.. English skills, and also strongly pro-clipboard-scraping views. Funny that.
makecheck 6y ago
Perhaps there should be a separate security level for “access whatever was just Copied in the last 4 seconds, if the only other action taken was to switch to the app requesting the clipboard”. Almost any app could clear that bar, since under those conditions it probably means “user grabbed something and wants to use it here”. What is the use case for “read whatever was copied from anywhere for any reason at any time”? If there is one (e.g. full-fledged word processor maybe), that should still be a separate entitlement and require a higher bar, e.g. extensive app review.
- vsareto 6y ago
  That's probably not going to work well because people use devices at different speeds
thekyle 6y ago
It does make me wonder how many apps on Android also do this and go completely undetected. Hopefully Google adds something similar.
- yen223 6y ago
  In my Android 10 phone, if I copy a piece of text that looks like an address and open Google Maps, Google Maps will immediately offer the copied text as a search option. Google Maps doesn't do this if I copied, say, some random numbers. I'm not sure how the Google Maps app can do this without snooping at my clipboard.
  - jankiehodgpodge 6y ago
    I'm pretty sure that's the OS itself analysing the highlighted text and offering suggestions on which app to open it with.
- dingaling 6y ago
  Background clipboard access is already blocked on Android, except for direct entry apps such as keyboards. Of course it's still possible to check the clipboard when the app receives focus, just like on iOS.
Ptrulli 6y ago
Do most of these apps mention this in their privacy terms? I would imagine it's somewhere in there, but who has the time to read all of that. This reminds me of HEY.com Apple is following suit in terms of notifying the user on privacy...
hilyen 6y ago
This is unacceptable.
deleted 6y ago
[deleted]
kstrauser 6y ago
iOS already prompts for other things like "app Foo would like to know your location: Never, Only when open, Always". Users are use to this. I'd love a popup like: "TikTok wants to see what you've copied into your clipboard: Never, Once, Always, Uninstall that spyware". Then I could make informed decisions, like sure, my package tracker can see if there's a FedEx URL in my clipboard. I'm OK with that. There's literally no reason why I'd ever want Instagram to check my clipboard, though. May you do, and you could give it permission.
- steve_taylor 6y ago
  It’s unbelievable that Apple would leave this security hole wide open for so long. Notifying the user is not enough.
  - filleduchaos 6y ago
    I would love to know what OS you're using that requires permissions for foreground app access to the system clipboard.
    - xvector 6y ago
      Other OSes aren't tooting the privacy horn from the top of a mountain.
      - filleduchaos 6y ago
        So you're okay with "massive security holes" as long as their creators aren't "tooting the privacy horn"? Interesting indeed.
        kinkrtyavimoodh 6y ago
        Yes, because a 'security hole' isn't a term defined a God. What security holes are holes or not is entirely a matter of user expectation.
- 6y ago
davidajackson 6y ago
clipboard access should really be permissioned just like mic access etc
- anticensor 6y ago
  Real solution is to make the clipboard behave like a channel (both must be running and target must be on foreground), not like a buffer. No permission mess.
keyle 6y ago
It would be easy to see foul play here... But I can only imagine the size of the development team behind such app and it's probably some dumb feature commit implemented by someone who isn't there anymore that checks to insert "Tok" every time someone types "Tik". Or some other evil purposes.
jedberg 6y ago
Here is an explanation from a 3rd party reddit app developer: tl;dr: Since Apple doesn't give a way to open URLs in 3rd party apps, he inspects the paste buffer for reddit URLs, but he aptly points out that he could read anything in the paste buffer if he wanted to: "Hey! I make Apollo for Reddit and a few people asked me about this and if Apollo does anything with the clipboard so I wanted to answer. Since iOS doesn't have a mechanism to open URLs in a specific third party app Apollo has a feature where if you open the app with a Reddit URL on your clipboard it'll offer to open that URL in Apollo, I think I copied this from Instapaper awhile ago. This does cause a potentially creepy looking notification with Apollo sometimes, but just wanted to explain why/what it's doing. It's literally just like "Hey iOS, is there a URL on the clipboard? Oh there is, is it a Reddit one? Okay cool let me ask them if they want to open it." Obviously at no point does anything else happen like it leaving the device or anything. It'll show this banner even if there's not a Reddit URL because it needs to check the URL to see if it's a Reddit URL in the first place. Schrodinger's Reddit URL. But the clipboard API (prior to iOS 14) was very open, as someone else said, what if medical records were on your clipboard as text? Well in Apollo's case, that doesn't qualify it as a URL, so it wouldn't even "look". (And even for URLs, it doesn't store a list of them even on the device, it just opens it if you ask to, and then saves the most recent URL so it won't keep repeatedly prompting you if you say no.) But that doesn't mean other apps couldn't be! They could be doing some Creepy Shit™ so I think this API change is good. It means I'll have to be more clear with Apollo doing this, and I've already had a few Apple engineers reach out with ways, but I think it's a very good change for user security." From: https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/fvscjyz/ https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...
- unityByFreedom 6y ago
  We need an answer from TikTok not Apollo.
  - jedberg 6y ago
    Of course. The point is there are legit reasons for this to happen.
spaetzleesser 6y ago
I think in general operating systems shouldn’t just ask the user for permissions when an app wants to do something. But they also should provide a log about when, to what extent and how often apps are using that permission. For example when I give an app permission to read message I still have no clue how often the app does it.
_jal 6y ago
The clipboard belongs to the user. It is quite obvious how clipboard-snooping could disclose sensitive information, and as far as writing to it, I should be able to expect the thing I copied last to be there when I hit paste next. I'd be in favor of banning application-initiated access entirely. I realize this would interfere with 1PW and similar. That was always a hack, and the fact that so many apps snoop on the clipboard is a great reason for it to stop! Sensitive dataflows for things like passwords need far better protection.
nullc 6y ago
I was shocked to find out that firefox enabled websites to access the clipboard sometime in the last five years or so. .. and I'm left stressed out that I could have had important passwords or key stolen this way. This can be disabled by setting a preference: https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ https://www.ghacks.net/2014/01/08/block-websites-reading-mod...
- lucasmullens 6y ago
  Firefox prompts for your permission to read from the clipboard: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Interact_with_the_clipboard https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... But I'm not sure if that's always been the case.
  - gruez 6y ago
    that's for addons, not websites
- gruez 6y ago
  I don't think that site's accurate. I searched around and there seems to be two ways of reading clipboard contents: making a fake dom element and waiting for the user to paste, or to use the async clipboard api. The first doesn't seem abusable because it requires you to actually paste something. The second doesn't seem to be supported by firefox, at least according to this demo: https://googlechrome.github.io/samples/async-clipboard/ https://googlechrome.github.io/samples/async-clipboard/.
dmurr91 6y ago
Duh
PatrolX 6y ago
Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits and keep a record of the IP addresses.
- zerd 6y ago
  You can also use something like requestbin/postbin to capture the whole requests and see IPs, headers etc.
- xvector 6y ago
  It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these holes though, they've been around for years. It's really depressing to see Apple's fantastic security work in other parts of the stack be completely and utterly compromised by OS design decisions like this.
  - greggman3 6y ago
    Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.
    - np_tedious 6y ago
      This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too
deleted 6y ago
[deleted]
giancarlostoro 6y ago
I wonder what this sort of spam does to your battery life. This really should be a permission configuration.
statictype 6y ago
Whats the point of having an App Store as the gatekeeper for installing apps if you aren’t going to catch this shit?
- CardenB 6y ago
  I believe iOS14 has features to detect this: https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/ https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches...
  - statictype 6y ago
    Yes - I mean why hasn't the App Store review process already caught this in previous versions of iOS? Why do we need to wait for the technical capability to be surfaced to users? How are we supposed to know if the app's continuous request for clipboard access is ok or not? I feel like that was literally the only value-add in the App Store review process and the fact that its a feature in iOS seems to indicate that Apple is throwing in the towel here and saying "we don't know if this is a privacy issue or not so we will just notify you about it".
deadbacon 6y ago
Lyft is doing the same thing. But it seems the frequency is lower compared to TikTok
- guug 6y ago
  People were saying the Google Maps also does it.
OldHand2018 6y ago
In the coming days I feel as if we are going to see a lot more threads about the new privacy features in iOS 14. Apple has a video overview of a lot of the new stuff [1]. I suggest watching it (at 2x speed - they talk very slowly). Especially at 16:30 where they emphasize that SDKs are part of your app and that you the developer are fully responsible for the data collection of any SDK you include in your app. This is going to be a huge problem for a lot of developers. [1] https://developer.apple.com/videos/play/wwdc2020/10676/ https://developer.apple.com/videos/play/wwdc2020/10676/
- drevil-v2 6y ago
  If by problem you mean end of laziness then sure. You can no longer drag and drop FB or google analytics SDK into your project, type in a few lines of glue code, email the product owner that you have added tracking capability into the app and head down to the pub to spend some of that well earned six figure developer salary. Now I am gleeful about this because it's win-win for me as a consumer and software engineer. Better privacy and use of my data as a consumer. More $$ work as an engineer when all those analytic pipelines need to be re-architected and rebuilt.
- askafriend 6y ago
  > This is going to be a huge problem for a lot of developers. The way I see it, it's not a problem it's a responsibility. The problem was the lack of responsibility in the first place.
- aneutron 6y ago
  That's it. I'm switching to iOS. Android is like child's play when it comes to privacy compared to the features introduced just in this version of iOS. I'm sure I'll hate the lack of customizability but at least the privacy features are solid.
product50 6y ago
This is the problem with Chinese apps. You just can't rely on them. They simply don't have the same principles of privacy like US companies do. Even Facebook won't do something like this.
- filleduchaos 6y ago
  Plenty of US companies build apps that do the exact same thing (checking your clipboard).
  - xbar 6y ago
    Do you like TikTok reading your clipboard?
    - filleduchaos 6y ago
      I don’t even have a TikTok account. I simply pay enough to have realized a long time ago that the contents of the system clipboard are available to the application that’s in the foreground on pretty much every OS I’ve used. Hence I have no need to jump to pearl-clutching xenophobia over it.
llacb47 6y ago
Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this: https://github.com/llacb47/mischosts/blob/master/tiktok-hosts https://github.com/llacb47/mischosts/blob/master/tiktok-host...
- throw03172019 6y ago
  Wow...I can’t imagine managing all of those.
- xvector 6y ago
  Genuine question, why don't companies proxy tracker data through a single host that the app also depends on to serve data? That way it wouldn't be possible for users to block individual hosts to prevent tracking. I guess it's not worth the effort though because laypeople won't care either way?
  - cleverpebble 6y ago
    Most trackers are 3rd parties that require you to go through their hosts. Additionally, these trackers are usually picked out by business analysts / product managers on different teams - so marketing my have their own tracking solution, sales might have their own, and engineering might have their own. Tends to be faster/easier to plop javascript on a page than engineering your own tracking/analytics pipeline at early stage startups
    - Xorlev 6y ago
      > Additionally, these trackers are usually picked out by business analysts / product managers on different teams This. I remember at my last company, we ended up with 8 or 9 different analytics tools all getting different data and showing one or two "cool views" the PM had put together. It's such a big problem that solutions like segment.io exist to broker your events to N different downstream solutions. Truly, this is the darkest timeline.
MintelIE 6y ago
We can expect every security hole possible to be exploited by these Chinese military apps. Heck, Fortnite intalls a rootkit on your PC for "anti-cheat" and that's even more egregious, yet it is allowed. The situation on Android is probably worse, most apps request access to everything these days and users are afraid to say "no" because of fear of breakage.
bigphishy 6y ago
Fu*king A... uh maybe we need to make Open Source required by law... just anything but this. WE as society cannot allow this impunity that is occurring by a very well powerful corporation, a nation-state sponsored Corporation, no less. Where does it end? Why do we allow this to occur? Why do members of our own society not know the perils of using this technology?
- opan 6y ago
  Finally someone tackles the real issue here. You can't trust proprietary software, no matter which country or company is behind it. Aim for free software instead of putting your trust in a company's black box.
bigphishy 6y ago
As society cannot allow this impunity of powerful corporations, a nation-state sponsored Corporation in this case. Why do members of our own society not know the negative effects of using this technology?
jasonlingx 6y ago
I use Bitwarden on my iPhone and sometimes copy passwords to the clipboard for some reason. Does this mean any app could have snooped on it without me knowing before?
- scarlac 6y ago
  Yes, that's probably part of the reason why 1Password clears the clipboard after a minute or so
  - jasonlingx 6y ago
    That’s crazy. IOS prompts before giving apps your location, clipboard data is many times more sensitive
austincheney 6y ago
TikTok users seem to be incredibly young, like children, so I doubt they care their privacy is violated.
navinsylvester 6y ago
Chinese investment money is everywhere so they try to control the narrative. I have seen for sometime that on HN, we are open to criticize but don't take a standpoint unless its something to do with western government. I think this is due to the flame war or rating system of HN, where active discussions are relegated to oblivion. Instead of trusting biased and funded media - we here need to introspect, without us being silenced. May be we are mostly left so we don't have a much stronger opinion unless its right - is that the case?. Just curious - why the slack?.
Abishek_Muthian 6y ago
Apps abusing clipboard can steal the passwords from the password managers when user copies it and associate with the user account via parallel construction. e.g. Time of stealing password from clipboard + time of my HN comment. I've been long weary of this, android 10 has made some changes like allowing only IME & in-focus apps to access the clipboard. Not a fool-proof way to prevent the issue. One more reason to destroy app duopoly, switch to pure Linux OS [1][2][3] and force app publishers to stick with web apps/PWA with more user control. [1]https://store.pine64.org/product/pinephone-community-edition-ubports-limited-edition-linux-smartphone/ https://store.pine64.org/product/pinephone-community-edition... [2]https://postmarketos.org/blog/2020/06/15/pinephone-postmarketos-community-edition/ https://postmarketos.org/blog/2020/06/15/pinephone-postmarke... [3]https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/
- brianush1 6y ago
  Apps can still read the clipboard at any time they want on Linux. A pure Linux OS is definitely better, but for other reasons.
deleted 6y ago
[deleted]
jayp1418 6y ago
At least signal messenger doesn't do this behaviour. Still keep incognito keyboard turned on from settings for extra protection: https://community.signalusers.org/t/ios-14-catches-apps-spying-on-clipboard/15254/2 https://community.signalusers.org/t/ios-14-catches-apps-spyi...
etaioinshrdlu 6y ago
Yet another reason web apps are generally better for security than native!
ed25519FUUU 6y ago
This is actually a big reason why I always prefer to use the mobile site instead of the app. The modern browser treats the web much more as an “unsafe” place. Not to mention I prefer standard ways to do things like “go back”. Plus you get Adblock.
ogre_codes 6y ago
I'm certain Apple knew in advance that a fair number of apps would trip this up and which ones were going to run into issues in advance. It's interesting that they went ahead and turned this on immediately without warning developers it was coming. Perhaps they wanted people to see what they were preventing.
- xsmasher 6y ago
  This is in a beta of iOS14. It's expected to have changes, sometimes breaking changes. This is the beta process working exactly as it should.
- hanspeter 6y ago
  > what they were preventing. You could also look at it as _what they had offered apps unlimited access to in the previous 13 OS versions_.
lxe 6y ago
Is this really news? Google maps suggests to navigate to an address you copied to the clipboard. No app should have permissions to access the clipboard without you explicitly selecting 'paste'
andrewPP 6y ago
It might be that an API that many of these apps use is using this feature.
jwiley 6y ago
It seems like this is nothing new: https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-apple-security-hack-if-you-have-tiktok-on-your-iphone-look-away-now/ https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-ap...
turowicz 6y ago
BREAKING NEWS: CARS ON MOTORWAY
apta 6y ago
Are we really surprised that a Chinese backed app is doing this?
gorgoiler 6y ago
Can one app copy data into the clipboard and then another app paste it out? They could even collude behind the scenes, once they’ve communicated over the clipboard as a channel to establish a link, to replace the original data in the clipboEOF[CITIZEN:8EF7720=FLAGGED]
willhay 6y ago
Crazy thing is that I would open TikTok on my phone and occasionally see a loading dialog that said "Pasting Clipboard" (from MacBook Pro). I finally freaked back in March and Googled it and found this... https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-apple-security-hack-if-you-have-tiktok-on-your-iphone-look-away-now/#6d5081731d61 https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-ap...
maartn 6y ago
It’s a shame that this turned into a discussion about iOS. It’s still the burglar that’s faulty, not the homeowner that leaves a window open
rurban 6y ago
This needs legislation. Apps should not be allowed to inspect foreign private content if they don't manage it. Only a few apps would need that. That new technical solution in the beta certainly comes handy, but legislation is better.
envolt 6y ago
I saw a video. Facebook app tries to connect to your local network. https://youtu.be/mclethck3sQ?t=71 https://youtu.be/mclethck3sQ?t=71
coronadisaster 6y ago
LoL... Why doesnt it block it in addition to revealing it? I don't think that it would break any features that I want to use.
itsbits 6y ago
Apple is fine with this but have a problem with hey.com's own charging structure!!!
pdimitar 6y ago
I applaud Apple for the continued privacy efforts, including finer-grained Photos access (linked by another poster in this thread: https://appleinsider.com/articles/20/06/24/apple-fine-tunes-photos-privacy-in-ios-14-to-tailor-access-to-specific-images https://appleinsider.com/articles/20/06/24/apple-fine-tunes-...). But at the same I can't help but be bitter. The smartphone scene is very active ever since, I don't know, 2011? All the companies and shady information dealers have gathered mountains of private information. Is this not too little, too late? This would have been welcome at the iPhone 5 release. Nowadays I wonder what difference would these measures even make.
- Majestic121 6y ago
  It is steps in the good directions, and as far as I know they are way more advanced than Android on this point. Those features would have been welcome a few years ago, that's for sure, but let's not blame them now that they do what's right. What's out there is already out there, you're right, but we can hope that those shady information dealers will have much more trouble in the future.
  - pdimitar 6y ago
    > It is steps in the good directions, and as far as I know they are way more advanced than Android on this point. I have the same impression. Which is saddening because I thought of going back part-time to Android and experiment with homelab builds and p2p architecture with a few spare Android devices. But I am not comfortable with how much and lower-level Google and the phone's vendor have and I am sure that no matter how I secure an app with access to photos/contacts/etc. then the kernel could likely still extract the info it needs... Don't know, but I am quite paranoid about smartphones lately. > let's not blame them now that they do what's right. Agreed. Better late than never. I simply feel that marketing trumps privacy concerns here. Apple wants to have what to brag about every year so features that should come once every 2-3 months are coming annually instead.
ngold 6y ago
Why is this still on their store? I assume it breaks their walled garden approach. It seems Apple is putting kids at risk, in fact it looks like kids are having their privacy actively abused.
waltpad 6y ago
I wonder how the clipboard API could be fixed. I suppose that the current scheme is that apps are monitoring paste events, and when it happens have a look at the clipboard for copied data. Perhaps the clipboard shouldn't be visible at all, and only when the user decides to paste content should the targeted app receive a "paste" message with the copied data (or perhaps some more complicated selection mechanism with a list of recent copies à la emacs). This would essentially merge the 2 steps process outlined above into a single operation. It's probably more complicated than that though.
- wslh 6y ago
  I think we should have some kind of "clipboard firewall" where you can restrict if a clipboard copy operation in an app X could be pasted in app Y. We have developed a free Windows app and will release it soon.
dana321 6y ago
It also revealed to me that that Dropbox was tracking my location in the background while i was traveling on a train..
boris-g 6y ago
Another reason to do this is support for keyboards with meme gifs and other pictures like kimoji. The way they work is by copying images to clipboard and expecting the user to paste manually. This can be streamlined in apps by checking clipboard contents every once in a while and if it changed to image when the input was in focus assuming the user intended to "type" an image or gif.
uptown 6y ago
I've been trying to bring the clipboard privacy issue to people's attention for awhile. https://news.ycombinator.com/item?id=21383241 https://news.ycombinator.com/item?id=21383241 Happy to see it's going mainstream. I'm hopeful that iOS 14 will provide a way to limit this behavior on a per-app basis.
teekert 6y ago
My bank (bunq) offers me to pay the iban (european bank account number) as soon as I open the app with an iban on te clipboard. That's the same, isn't it?
- giarc 6y ago
  In the twitter video Tik Tok is pasting from Instagram though. I also don't know why Tik Tok would be looking for text on the clipboard (to be fair I've never used Tik Tok though).
dreamcompiler 6y ago
TikTok is known to be Chinese malware. Is anybody on HN surprised by this? https://www.military.com/daily-news/2019/12/30/army-follows-pentagon-guidance-bans-chinese-owned-tiktok-app.html https://www.military.com/daily-news/2019/12/30/army-follows-...
- kpennell 6y ago
  I know this and I get it....but damn it's so much more entertaining than Instagram now. The content is more varied, more raw, and the for you page filtering is so well-tailored.
kinnth 6y ago
Is it even clear whether this data is being sent back to Tiktok or any company or is it simply to check for activating keywords to add app functionality? Is it all done locally?
BFatts 6y ago
I find it interesting that people automatically assume nefarious reasons for accessing the clipboard... If your privacy is so important, don't use platforms you cannot trust. If that means not using a smart phone, then maybe you will do something positive for yourself.
andy_ppp 6y ago
Is there any logical reason to do this apart from harvesting things people have copied. Seems purely evil to me?
feelix 6y ago
if only they'd do this for apps accessing the microphone, or do the same thing as they do with the camera making the application visibly request access
ipiz0618 6y ago
Zoom, WeChat, Weibo has all been exposed of sending users' data back to Chinese servers. Why would TikTok be different? It's already alarming enough that a Chinese social media app is at the top of the App Store. People need to learn to stop trusting these apps.
nerdjon 6y ago
Woke up this morning thinking... There is a part of me that is little sad Apple did not just wait to add this feature until iOS 14 released or one of the last GM's. If only because it would be a huge wakeup call for users about what their apps are doing and possibly collecting, instead of it all being patched out now. Instead we are seeing basically no traction on this outside of tech circles.
vecio 6y ago
TikTok and many popular Chinese apps, including Taobao, Baidu, and Alipay, to name a few, snoop clipboard contents, because Tencent censors and forbids almost all kind of links sharing in WeChat and QQ. https://news.ycombinator.com/item?id=23654345 https://news.ycombinator.com/item?id=23654345
NN88 6y ago
Apple is really setting the tone.

1847 points by georgespencer 6y ago

I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin. I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

riskable 6y ago
The problem is that iOS doesn't differentiate between a call that merely checks for the presence of a clipboard entry (e.g. so you can enable "Paste" in a menu/submenu) and actually copying the contents of the clipboard. The workaround (for legitimate apps) is to simply always keep that "Paste" option enabled--even if the clipboard is empty. That way you won't freak out your users and only suffer the most minor of usability consequences. Having said that I don't think TikTok has any relevant functionality such as enabling a "Paste" option so... Most likely nefarious!
- selsta 6y ago
  iOS differentiates between this since iOS 10: https://developer.apple.com/documentation/uikit/uipasteboard/1829416-hasstrings https://developer.apple.com/documentation/uikit/uipasteboard... Also iOS 14 has new clipboard related APIs to further check the content without actually accessing it.
  - BoorishBears 6y ago
    If iOS 14 adds new APIs to check, then I wouldn't be surprised if the codepath hasStrings uses triggers the warning The purpose of hasStrings was performance not indicating intent, so that wouldn't be surprising
- pininja 6y ago
  > I don't think TikTok has any relevant functionality Does pasting text into a video as an annotation require “Paste” to be enabled in this way?
  - ladberg 6y ago
    I believe any time you paste with the native keyboard UI up it doesn't go through the app. You only need to snoop the clipboard if you want to proactively use the data without having the user paste.
WrtCdEvrydy 6y ago
this is weird, you usually can't past data from clipboard (part of the browser sandbox). copying into the clipboard is free, pasting is not. Edit: This seems to be the app TikTok, not a website.
moonchild 6y ago
It is a risk. There's an easier solution, though. about:config -> dom.event.clipboardevents.enabled=false
ciarannolan 6y ago
A Yubikey or similar device is a good way to mitigate the damage of having your password manager's password stolen. https://bitwarden.com/help/article/setup-two-step-login-yubikey/ https://bitwarden.com/help/article/setup-two-step-login-yubi...
- rvz 6y ago
  And for macOS users, Touch ID takes this further without any devices, dongles or passwords, which 1Password, Dashlane, etc already supports.
  - ciarannolan 6y ago
    It seems to me that Touch ID is slightly less secure, given that it stores your fingerprint on the device and you rely on the Apple module and crypto to be implemented securely. With a Yubikey, the only thing you have to do to stay secure is to not lose it or let others use it.
    - judge2020 6y ago
      The attack surface is larger but it's still not an attack almost anyone needs to worry about - a 0 day on the T2 (which has never been publicly found/reported on) is something only worthy of nation state attacks on other nation states.
sgloutnikov 6y ago
For this reason, I switched to using a PIN for Bitwarden in the browser plugin. I don't have to use my master password every time.
nmaggioni 6y ago
I had the same exact concern, and I haven't been able to find reliable confirmations on this being completely impossible either. It's easily testable, though, that a webpage that isn't focused (because an extension's pane is open) doesn't receive input events. Likewise, Chrome [1] and Firefox [2] extensions themselves cannot bind to relevant keys for example. All in all I would say that going through an empty tab is unnecessary - even though I got into the habit of doing it as well - and even if this wasn't true 2FA should be enough to thwart most malicious actors. [1]: https://developer.chrome.com/extensions/commands https://developer.chrome.com/extensions/commands [2]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/commands#Shortcut_values https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
- odensc 6y ago
  Well, you probably couldn't find any confirmation because nothing in the security world is completely impossible :) Webpages aren't supposed to be able to receive input events when the extension popup is open, but there could still be an unknown vulnerability in Chrome/Firefox. So if you care enough it's best to mitigate that risk by using the standalone application for your password manager, or better yet use a completely separate device like your phone!
odensc 6y ago
On Chrome at least, Bitwarden has it's own extension popup window with the vault. This is a completely separate web context. There's no way for the open website to detect your keystrokes barring a vulnerability in Chrome itself. If you really want to be safe, you should use the standalone desktop apps and skip the browser extension altogether. Doing that empty tab thing probably doesn't protect you from anything.
neetodavid 6y ago
I took a short look at this and it appears to be a work in progress that varies between browsers... Chrome implements a "clipboard-read" permission that can be requested by calling navigator.clipboard.read(). When a page calls that it will display a permission request dialog (like those asking for permission to show notifications on seemingly every single news web page). A little clipboard icon will also appear in the nav bar showing the status of the permission (visible after a read attempt is made during that visit) Firefox is apparently on track as well, although for now the clipboard.read function is not implemented for pages and can only be called by extensions. I'm not sure what the permission dialog for extensions is like. https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A... So... it may be safe. But it is a work in progress and each browser is different. I've only checked the most well-documented method for reading the clipboard... maybe there is some other half-implemented feature or event listener that happens to leak some clipboard data...

_6fmb 6y ago

Hopefully we can turn this off, this is going to destroy usability be very annoying.

adamhearn 6y ago
You mean so you can snoop from the user without being detected?
- _6fmb 6y ago
  There are a lot of valid usecases for clipboard saving, I don't have an iOS app but I run CopyClip which would be kinda ruined by this "feature".
  - remmargorp64 6y ago
    Then there should be a setting that has to be manually approved to allow the clipboard interactivity feature. I use a password manager on my iPhone and I am copying and pasting my passwords all the time. If some random app is scraping my clipboard silently and sending the data to a third party, that means my passwords are compromised. I am very much NOT OK WITH THIS. Keep in mind, this permission should be fundamentally different than the permissions for just manually copying and pasting. I don't want to have to deal with permissions to "allow clipboard use" that I have to approve every time I want to paste something. That would be obnoxious. I am only worried about restricting permissions for invisible passive snooping.
xsmasher 6y ago
The developer can fix it by either (1) querying "is there clipboard content?" instead of copying it every few keystrokes or (2) stop altogether if there is no legit purpose. It sounds like this feature is working as intended - closing was was a silent security risk.

beamatronic 6y ago

Why does any app have access to the clipboard? Seems like a big security hole.

csa 6y ago
In order to know when you should enable the paste option. It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.
- landryraccoon 6y ago
  Couldn't IOS just have a peek API that tells the application if the clipboard is empty or not without revealing it's contents?
  - RandallBrown 6y ago
    They've had one for several years. https://developer.apple.com/documentation/uikit/uipasteboard/1829416-hasstrings https://developer.apple.com/documentation/uikit/uipasteboard...
  - deleted 6y ago
    [deleted]
- m0xte 6y ago
  Perhaps the destination should define whether or not you can paste into it and the OS can provide that option instead. This looks like a violation of “tell, don’t ask”.
- beamatronic 6y ago
  I should be able to paste into specific GUI elements that allow pasting. The application presenting the GUI element to me should be blind to whether I typed that data, or pasted it into there.
- creato 6y ago
  > It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy. For decades, all programs running on your computer had access to the clipboard. A primary intended purpose of the clipboard is precisely to share information between different programs. Maybe it is in fact a security issue that should be rethought, but calling it an abuse of privacy seems extreme.

ycombonator 6y ago

Chinese Communist Party [1] [1] https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-china-national-security-investigation https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-...

mobilio 6y ago

hm... seems that privacy issue: https://developer.apple.com/app-store/review/guidelines/#privacy https://developer.apple.com/app-store/review/guidelines/#pri... can led to ban from AppStore

dan-robertson 6y ago
Fortunately for tiktok, such rules only apply to small apps. They will probably get a polite phone call from a VP asking them to please stop doing that but noting more.
riskable 6y ago
Oh yes! Please! I have wild fantasies about TikTok being banned like that. "Why was TikTok banned?" "Because the violated the basic capitalistic principal of existing not to make money but to amass a Nazi-like ledger/database of every person in the world on behalf of a nation state."

grecy 6y ago

Fairly impressive if true - they must have already gobbled up tens of millions of passwords and other sensitive data that users had no idea was being stolen from their clipboard.

radomysisky 6y ago
To the coffers of the CCP.
- dang 6y ago
  Since you're obviously using this site primarily for ideological battle, and that's against the rules here, we've banned the account. No, not because we're communists. Rather, this is an existential issue for HN: if we want to have a forum for curious conversation, we have to limit the amount of damage people can inflict on it in this way. Please don't create accounts to break HN's guidelines with. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

triceratops 6y ago

Let's be real. Is anyone honestly surprised?

rhizome 6y ago
"Surprise" is not a good standard for concern.
- avh02 6y ago
  Depends on what you're doing, driving or flying - you don't want surprises, they'd definitely be concerning. Privacy too in my opinion.
  - rhizome 6y ago
    You're driving along and get t-boned by a semi. Someone says, "I don't know why anybody's surprised, the crash happened at an intersection where two roads cross perpendicularly, and vehicles are traveling on those roads," are you going to nod at their profound observation?

ferest 6y ago

running old app on new OS can cause unpredicted behavior is normal, and here is assuming it is not iOS14 bug

RandallBrown 6y ago
iOS 14 added this feature (the clipboard notification) to catch this type of behavior. It's possible that TikTok isn't doing anything and this is a bug, but it's more likely they're using the clipboard in a way they shouldn't.

harpastum 6y ago

It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification. If TikTok is actually constantly loading the clipboard, that's obviously terrible. I'd bet this behavior is gone by the next release, and that shows how useful this new notification is. Same issue with notes from that app's developer saying what's going on and how they will fix it: https://twitter.com/ecormany/status/1275903947899797505 https://twitter.com/ecormany/status/1275903947899797505

_bxg1 6y ago
> There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button) People keep saying this but I've never seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing every app to be reading my clipboard at all times. It's inexcusable to me that there isn't a permissions prompt for this. Two of my most common types copy-pasted strings are URLs and passwords.
- jborichevskiy 6y ago
  > I've never seen one of these app-specific paste widgets IIRC having an address (or address-looking string) in your clipboard will cause it to show up as the first result on the search screen in Google Maps.
  - guug 6y ago
    So google also sends the contents of my clipboard to their servers when I use their app? Wonderful.
    - xvector 6y ago
      I can't imagine being one of the PMs/higher-ups that decided to allow clipboard content to be shared willy-nilly like this. Like, what must be going through their minds when they make decisions like this? "User experience at all costs?" Seems contrary to their stance on privacy.

speedyapoc 6y ago

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

radomysisky 6y ago
Should we still be giving the benefit of the doubt to a Chinese-owned honeypot in 2020?
- sgjohnson 6y ago
  Absolutely not.
tempestn 6y ago
You'd think if the user knew to copy a tracking code into their clipboard, they could also paste it into the appropriate field without the app needing to extract it for them. Edit: fair responses, all. You've convinced me.
- mkenyon 6y ago
  I mean, sure, you're technically correct, but you're missing the point. For just one example, it's so heckin' convenient when an app recognizes that you have a 2FA token in your clipboard copied from your 2FA app and "pastes" it for you automatically.
- the_pwner224 6y ago
  Not having to paste is very useful. Especially on mobile where pasting is slow and tedious. A few months ago I would have said the same thing as you, but then I experienced some applications which looked at what I had copied and automatically did all the hard work. It's a pleasant surprise to see it happen, and having experienced it, I am happy that the applications have this functionality. Of course if you're living in a world where all the code on your device is considered hostile, then you may not want this. But I use almost only free software and there you can generally start with a presumption of goodwill instead of starting with a feeling of distrust, like with TikTok.

vxNsr 6y ago

Appears that a lot of third party apps are just using an older api that forces this notification to show. a lot less nefarious than it originally appears. Seems that iOS14 offers a specific new API to check if there's something on the clipboard without actually seeing it which is what all these apps are trying to do.

RandallBrown 6y ago
The API to check if the clipboard has contents has existed since iOS 10. > Starting in iOS 10, the UIPasteboard class provides properties for directly checking whether specific data types are present on a pasteboard, described in Checking for Data Types on a Pasteboard. Use these properties, rather than attempting to read pasteboard data, to avoid causing the system to needlessly attempt to fetch data before it is needed or when the data might not be present. https://developer.apple.com/documentation/uikit/uipasteboard https://developer.apple.com/documentation/uikit/uipasteboard
- cynix 6y ago
  That doesn’t seem to stop the app from checking for, say, string content, and getting access to a copied password.

SirensOfTitan 6y ago

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/ https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...)

alfalfasprout 6y ago
People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.
- dheera 6y ago
  I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy. Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly. For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of luck and can only just choose to not use the app. On Android (by modifying the OS) you can actually send back fake IMU data to make the app think it got the permissions it wanted but really didn't. Or you can let access to your photos, but only let it see a walled garden of a few select photos.
  - Skunkleton 6y ago
    You're right, but you are also missing the point. Consumers in general have access to one of only a few options for computing tasks. To date, of these mainstream options, only Apple is taking a meaningful stance on privacy. Is it self-serving, sub-optimal, or otherwise broken? Probably. Is it the best thing for privacy currently widely available? Probably.

hkt 6y ago

I note with interest some commenters with.. interesting.. English skills, and also strongly pro-clipboard-scraping views. Funny that.

makecheck 6y ago

Perhaps there should be a separate security level for “access whatever was just Copied in the last 4 seconds, if the only other action taken was to switch to the app requesting the clipboard”. Almost any app could clear that bar, since under those conditions it probably means “user grabbed something and wants to use it here”. What is the use case for “read whatever was copied from anywhere for any reason at any time”? If there is one (e.g. full-fledged word processor maybe), that should still be a separate entitlement and require a higher bar, e.g. extensive app review.

vsareto 6y ago
That's probably not going to work well because people use devices at different speeds

thekyle 6y ago

It does make me wonder how many apps on Android also do this and go completely undetected. Hopefully Google adds something similar.

yen223 6y ago
In my Android 10 phone, if I copy a piece of text that looks like an address and open Google Maps, Google Maps will immediately offer the copied text as a search option. Google Maps doesn't do this if I copied, say, some random numbers. I'm not sure how the Google Maps app can do this without snooping at my clipboard.
- jankiehodgpodge 6y ago
  I'm pretty sure that's the OS itself analysing the highlighted text and offering suggestions on which app to open it with.
dingaling 6y ago
Background clipboard access is already blocked on Android, except for direct entry apps such as keyboards. Of course it's still possible to check the clipboard when the app receives focus, just like on iOS.

Ptrulli 6y ago

Do most of these apps mention this in their privacy terms? I would imagine it's somewhere in there, but who has the time to read all of that. This reminds me of HEY.com Apple is following suit in terms of notifying the user on privacy...

hilyen 6y ago

This is unacceptable.

deleted 6y ago

[deleted]

kstrauser 6y ago

iOS already prompts for other things like "app Foo would like to know your location: Never, Only when open, Always". Users are use to this. I'd love a popup like: "TikTok wants to see what you've copied into your clipboard: Never, Once, Always, Uninstall that spyware". Then I could make informed decisions, like sure, my package tracker can see if there's a FedEx URL in my clipboard. I'm OK with that. There's literally no reason why I'd ever want Instagram to check my clipboard, though. May you do, and you could give it permission.

steve_taylor 6y ago
It’s unbelievable that Apple would leave this security hole wide open for so long. Notifying the user is not enough.
- filleduchaos 6y ago
  I would love to know what OS you're using that requires permissions for foreground app access to the system clipboard.
  - xvector 6y ago
    Other OSes aren't tooting the privacy horn from the top of a mountain.
    - filleduchaos 6y ago
      So you're okay with "massive security holes" as long as their creators aren't "tooting the privacy horn"? Interesting indeed.
      - kinkrtyavimoodh 6y ago
        Yes, because a 'security hole' isn't a term defined a God. What security holes are holes or not is entirely a matter of user expectation.
6y ago

davidajackson 6y ago

clipboard access should really be permissioned just like mic access etc

anticensor 6y ago
Real solution is to make the clipboard behave like a channel (both must be running and target must be on foreground), not like a buffer. No permission mess.

keyle 6y ago

It would be easy to see foul play here... But I can only imagine the size of the development team behind such app and it's probably some dumb feature commit implemented by someone who isn't there anymore that checks to insert "Tok" every time someone types "Tik". Or some other evil purposes.

jedberg 6y ago

Here is an explanation from a 3rd party reddit app developer: tl;dr: Since Apple doesn't give a way to open URLs in 3rd party apps, he inspects the paste buffer for reddit URLs, but he aptly points out that he could read anything in the paste buffer if he wanted to: "Hey! I make Apollo for Reddit and a few people asked me about this and if Apollo does anything with the clipboard so I wanted to answer. Since iOS doesn't have a mechanism to open URLs in a specific third party app Apollo has a feature where if you open the app with a Reddit URL on your clipboard it'll offer to open that URL in Apollo, I think I copied this from Instapaper awhile ago. This does cause a potentially creepy looking notification with Apollo sometimes, but just wanted to explain why/what it's doing. It's literally just like "Hey iOS, is there a URL on the clipboard? Oh there is, is it a Reddit one? Okay cool let me ask them if they want to open it." Obviously at no point does anything else happen like it leaving the device or anything. It'll show this banner even if there's not a Reddit URL because it needs to check the URL to see if it's a Reddit URL in the first place. Schrodinger's Reddit URL. But the clipboard API (prior to iOS 14) was very open, as someone else said, what if medical records were on your clipboard as text? Well in Apollo's case, that doesn't qualify it as a URL, so it wouldn't even "look". (And even for URLs, it doesn't store a list of them even on the device, it just opens it if you ask to, and then saves the most recent URL so it won't keep repeatedly prompting you if you say no.) But that doesn't mean other apps couldn't be! They could be doing some Creepy Shit™ so I think this API change is good. It means I'll have to be more clear with Apollo doing this, and I've already had a few Apple engineers reach out with ways, but I think it's a very good change for user security." From: https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/fvscjyz/ https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...

unityByFreedom 6y ago
We need an answer from TikTok not Apollo.
- jedberg 6y ago
  Of course. The point is there are legit reasons for this to happen.

spaetzleesser 6y ago

I think in general operating systems shouldn’t just ask the user for permissions when an app wants to do something. But they also should provide a log about when, to what extent and how often apps are using that permission. For example when I give an app permission to read message I still have no clue how often the app does it.

_jal 6y ago

The clipboard belongs to the user. It is quite obvious how clipboard-snooping could disclose sensitive information, and as far as writing to it, I should be able to expect the thing I copied last to be there when I hit paste next. I'd be in favor of banning application-initiated access entirely. I realize this would interfere with 1PW and similar. That was always a hack, and the fact that so many apps snoop on the clipboard is a great reason for it to stop! Sensitive dataflows for things like passwords need far better protection.

nullc 6y ago

I was shocked to find out that firefox enabled websites to access the clipboard sometime in the last five years or so. .. and I'm left stressed out that I could have had important passwords or key stolen this way. This can be disabled by setting a preference: https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ https://www.ghacks.net/2014/01/08/block-websites-reading-mod...

lucasmullens 6y ago
Firefox prompts for your permission to read from the clipboard: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Interact_with_the_clipboard https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... But I'm not sure if that's always been the case.
- gruez 6y ago
  that's for addons, not websites
gruez 6y ago
I don't think that site's accurate. I searched around and there seems to be two ways of reading clipboard contents: making a fake dom element and waiting for the user to paste, or to use the async clipboard api. The first doesn't seem abusable because it requires you to actually paste something. The second doesn't seem to be supported by firefox, at least according to this demo: https://googlechrome.github.io/samples/async-clipboard/ https://googlechrome.github.io/samples/async-clipboard/.

dmurr91 6y ago

Duh

PatrolX 6y ago

Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy that bitly link to your clipboard and repeat what you're doing in that video. Monitor the bitly link for clicks. Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits and keep a record of the IP addresses.

zerd 6y ago
You can also use something like requestbin/postbin to capture the whole requests and see IPs, headers etc.
xvector 6y ago
It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these holes though, they've been around for years. It's really depressing to see Apple's fantastic security work in other parts of the stack be completely and utterly compromised by OS design decisions like this.
- greggman3 6y ago
  Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.
  - np_tedious 6y ago
    This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too

deleted 6y ago

[deleted]

giancarlostoro 6y ago

I wonder what this sort of spam does to your battery life. This really should be a permission configuration.

statictype 6y ago

Whats the point of having an App Store as the gatekeeper for installing apps if you aren’t going to catch this shit?

CardenB 6y ago
I believe iOS14 has features to detect this: https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/ https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches...
- statictype 6y ago
  Yes - I mean why hasn't the App Store review process already caught this in previous versions of iOS? Why do we need to wait for the technical capability to be surfaced to users? How are we supposed to know if the app's continuous request for clipboard access is ok or not? I feel like that was literally the only value-add in the App Store review process and the fact that its a feature in iOS seems to indicate that Apple is throwing in the towel here and saying "we don't know if this is a privacy issue or not so we will just notify you about it".

deadbacon 6y ago

Lyft is doing the same thing. But it seems the frequency is lower compared to TikTok

guug 6y ago
People were saying the Google Maps also does it.

OldHand2018 6y ago

In the coming days I feel as if we are going to see a lot more threads about the new privacy features in iOS 14. Apple has a video overview of a lot of the new stuff [1]. I suggest watching it (at 2x speed - they talk very slowly). Especially at 16:30 where they emphasize that SDKs are part of your app and that you the developer are fully responsible for the data collection of any SDK you include in your app. This is going to be a huge problem for a lot of developers. [1] https://developer.apple.com/videos/play/wwdc2020/10676/ https://developer.apple.com/videos/play/wwdc2020/10676/

drevil-v2 6y ago
If by problem you mean end of laziness then sure. You can no longer drag and drop FB or google analytics SDK into your project, type in a few lines of glue code, email the product owner that you have added tracking capability into the app and head down to the pub to spend some of that well earned six figure developer salary. Now I am gleeful about this because it's win-win for me as a consumer and software engineer. Better privacy and use of my data as a consumer. More $$ work as an engineer when all those analytic pipelines need to be re-architected and rebuilt.
askafriend 6y ago
> This is going to be a huge problem for a lot of developers. The way I see it, it's not a problem it's a responsibility. The problem was the lack of responsibility in the first place.
aneutron 6y ago
That's it. I'm switching to iOS. Android is like child's play when it comes to privacy compared to the features introduced just in this version of iOS. I'm sure I'll hate the lack of customizability but at least the privacy features are solid.

product50 6y ago

This is the problem with Chinese apps. You just can't rely on them. They simply don't have the same principles of privacy like US companies do. Even Facebook won't do something like this.

filleduchaos 6y ago
Plenty of US companies build apps that do the exact same thing (checking your clipboard).
- xbar 6y ago
  Do you like TikTok reading your clipboard?
  - filleduchaos 6y ago
    I don’t even have a TikTok account. I simply pay enough to have realized a long time ago that the contents of the system clipboard are available to the application that’s in the foreground on pretty much every OS I’ve used. Hence I have no need to jump to pearl-clutching xenophobia over it.

llacb47 6y ago

Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere. Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this: https://github.com/llacb47/mischosts/blob/master/tiktok-hosts https://github.com/llacb47/mischosts/blob/master/tiktok-host...

throw03172019 6y ago
Wow...I can’t imagine managing all of those.
xvector 6y ago
Genuine question, why don't companies proxy tracker data through a single host that the app also depends on to serve data? That way it wouldn't be possible for users to block individual hosts to prevent tracking. I guess it's not worth the effort though because laypeople won't care either way?
- cleverpebble 6y ago
  Most trackers are 3rd parties that require you to go through their hosts. Additionally, these trackers are usually picked out by business analysts / product managers on different teams - so marketing my have their own tracking solution, sales might have their own, and engineering might have their own. Tends to be faster/easier to plop javascript on a page than engineering your own tracking/analytics pipeline at early stage startups
  - Xorlev 6y ago
    > Additionally, these trackers are usually picked out by business analysts / product managers on different teams This. I remember at my last company, we ended up with 8 or 9 different analytics tools all getting different data and showing one or two "cool views" the PM had put together. It's such a big problem that solutions like segment.io exist to broker your events to N different downstream solutions. Truly, this is the darkest timeline.

MintelIE 6y ago

We can expect every security hole possible to be exploited by these Chinese military apps. Heck, Fortnite intalls a rootkit on your PC for "anti-cheat" and that's even more egregious, yet it is allowed. The situation on Android is probably worse, most apps request access to everything these days and users are afraid to say "no" because of fear of breakage.

bigphishy 6y ago

Fu*king A... uh maybe we need to make Open Source required by law... just anything but this. WE as society cannot allow this impunity that is occurring by a very well powerful corporation, a nation-state sponsored Corporation, no less. Where does it end? Why do we allow this to occur? Why do members of our own society not know the perils of using this technology?

opan 6y ago
Finally someone tackles the real issue here. You can't trust proprietary software, no matter which country or company is behind it. Aim for free software instead of putting your trust in a company's black box.

bigphishy 6y ago

As society cannot allow this impunity of powerful corporations, a nation-state sponsored Corporation in this case. Why do members of our own society not know the negative effects of using this technology?

jasonlingx 6y ago

I use Bitwarden on my iPhone and sometimes copy passwords to the clipboard for some reason. Does this mean any app could have snooped on it without me knowing before?

scarlac 6y ago
Yes, that's probably part of the reason why 1Password clears the clipboard after a minute or so
- jasonlingx 6y ago
  That’s crazy. IOS prompts before giving apps your location, clipboard data is many times more sensitive

austincheney 6y ago

TikTok users seem to be incredibly young, like children, so I doubt they care their privacy is violated.

navinsylvester 6y ago

Chinese investment money is everywhere so they try to control the narrative. I have seen for sometime that on HN, we are open to criticize but don't take a standpoint unless its something to do with western government. I think this is due to the flame war or rating system of HN, where active discussions are relegated to oblivion. Instead of trusting biased and funded media - we here need to introspect, without us being silenced. May be we are mostly left so we don't have a much stronger opinion unless its right - is that the case?. Just curious - why the slack?.

Abishek_Muthian 6y ago

Apps abusing clipboard can steal the passwords from the password managers when user copies it and associate with the user account via parallel construction. e.g. Time of stealing password from clipboard + time of my HN comment. I've been long weary of this, android 10 has made some changes like allowing only IME & in-focus apps to access the clipboard. Not a fool-proof way to prevent the issue. One more reason to destroy app duopoly, switch to pure Linux OS [1][2][3] and force app publishers to stick with web apps/PWA with more user control. [1]https://store.pine64.org/product/pinephone-community-edition-ubports-limited-edition-linux-smartphone/ https://store.pine64.org/product/pinephone-community-edition... [2]https://postmarketos.org/blog/2020/06/15/pinephone-postmarketos-community-edition/ https://postmarketos.org/blog/2020/06/15/pinephone-postmarke... [3]https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/

brianush1 6y ago
Apps can still read the clipboard at any time they want on Linux. A pure Linux OS is definitely better, but for other reasons.

deleted 6y ago

[deleted]

jayp1418 6y ago

At least signal messenger doesn't do this behaviour. Still keep incognito keyboard turned on from settings for extra protection: https://community.signalusers.org/t/ios-14-catches-apps-spying-on-clipboard/15254/2 https://community.signalusers.org/t/ios-14-catches-apps-spyi...

etaioinshrdlu 6y ago

Yet another reason web apps are generally better for security than native!

ed25519FUUU 6y ago

This is actually a big reason why I always prefer to use the mobile site instead of the app. The modern browser treats the web much more as an “unsafe” place. Not to mention I prefer standard ways to do things like “go back”. Plus you get Adblock.

ogre_codes 6y ago

I'm certain Apple knew in advance that a fair number of apps would trip this up and which ones were going to run into issues in advance. It's interesting that they went ahead and turned this on immediately without warning developers it was coming. Perhaps they wanted people to see what they were preventing.

xsmasher 6y ago
This is in a beta of iOS14. It's expected to have changes, sometimes breaking changes. This is the beta process working exactly as it should.
hanspeter 6y ago
> what they were preventing. You could also look at it as _what they had offered apps unlimited access to in the previous 13 OS versions_.

lxe 6y ago

Is this really news? Google maps suggests to navigate to an address you copied to the clipboard. No app should have permissions to access the clipboard without you explicitly selecting 'paste'

andrewPP 6y ago

It might be that an API that many of these apps use is using this feature.

jwiley 6y ago

It seems like this is nothing new: https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-apple-security-hack-if-you-have-tiktok-on-your-iphone-look-away-now/ https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-ap...

turowicz 6y ago

BREAKING NEWS: CARS ON MOTORWAY

apta 6y ago

Are we really surprised that a Chinese backed app is doing this?

gorgoiler 6y ago

Can one app copy data into the clipboard and then another app paste it out? They could even collude behind the scenes, once they’ve communicated over the clipboard as a channel to establish a link, to replace the original data in the clipboEOF[CITIZEN:8EF7720=FLAGGED]

willhay 6y ago

Crazy thing is that I would open TikTok on my phone and occasionally see a loading dialog that said "Pasting Clipboard" (from MacBook Pro). I finally freaked back in March and Googled it and found this... https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-apple-security-hack-if-you-have-tiktok-on-your-iphone-look-away-now/#6d5081731d61 https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-ap...

maartn 6y ago

It’s a shame that this turned into a discussion about iOS. It’s still the burglar that’s faulty, not the homeowner that leaves a window open

rurban 6y ago

This needs legislation. Apps should not be allowed to inspect foreign private content if they don't manage it. Only a few apps would need that. That new technical solution in the beta certainly comes handy, but legislation is better.

envolt 6y ago

I saw a video. Facebook app tries to connect to your local network. https://youtu.be/mclethck3sQ?t=71 https://youtu.be/mclethck3sQ?t=71

coronadisaster 6y ago

LoL... Why doesnt it block it in addition to revealing it? I don't think that it would break any features that I want to use.

itsbits 6y ago

Apple is fine with this but have a problem with hey.com's own charging structure!!!

pdimitar 6y ago

I applaud Apple for the continued privacy efforts, including finer-grained Photos access (linked by another poster in this thread: https://appleinsider.com/articles/20/06/24/apple-fine-tunes-photos-privacy-in-ios-14-to-tailor-access-to-specific-images https://appleinsider.com/articles/20/06/24/apple-fine-tunes-...). But at the same I can't help but be bitter. The smartphone scene is very active ever since, I don't know, 2011? All the companies and shady information dealers have gathered mountains of private information. Is this not too little, too late? This would have been welcome at the iPhone 5 release. Nowadays I wonder what difference would these measures even make.

Majestic121 6y ago
It is steps in the good directions, and as far as I know they are way more advanced than Android on this point. Those features would have been welcome a few years ago, that's for sure, but let's not blame them now that they do what's right. What's out there is already out there, you're right, but we can hope that those shady information dealers will have much more trouble in the future.
- pdimitar 6y ago
  > It is steps in the good directions, and as far as I know they are way more advanced than Android on this point. I have the same impression. Which is saddening because I thought of going back part-time to Android and experiment with homelab builds and p2p architecture with a few spare Android devices. But I am not comfortable with how much and lower-level Google and the phone's vendor have and I am sure that no matter how I secure an app with access to photos/contacts/etc. then the kernel could likely still extract the info it needs... Don't know, but I am quite paranoid about smartphones lately. > let's not blame them now that they do what's right. Agreed. Better late than never. I simply feel that marketing trumps privacy concerns here. Apple wants to have what to brag about every year so features that should come once every 2-3 months are coming annually instead.

ngold 6y ago

Why is this still on their store? I assume it breaks their walled garden approach. It seems Apple is putting kids at risk, in fact it looks like kids are having their privacy actively abused.

waltpad 6y ago

I wonder how the clipboard API could be fixed. I suppose that the current scheme is that apps are monitoring paste events, and when it happens have a look at the clipboard for copied data. Perhaps the clipboard shouldn't be visible at all, and only when the user decides to paste content should the targeted app receive a "paste" message with the copied data (or perhaps some more complicated selection mechanism with a list of recent copies à la emacs). This would essentially merge the 2 steps process outlined above into a single operation. It's probably more complicated than that though.

wslh 6y ago
I think we should have some kind of "clipboard firewall" where you can restrict if a clipboard copy operation in an app X could be pasted in app Y. We have developed a free Windows app and will release it soon.

dana321 6y ago

It also revealed to me that that Dropbox was tracking my location in the background while i was traveling on a train..

boris-g 6y ago

Another reason to do this is support for keyboards with meme gifs and other pictures like kimoji. The way they work is by copying images to clipboard and expecting the user to paste manually. This can be streamlined in apps by checking clipboard contents every once in a while and if it changed to image when the input was in focus assuming the user intended to "type" an image or gif.

uptown 6y ago

I've been trying to bring the clipboard privacy issue to people's attention for awhile. https://news.ycombinator.com/item?id=21383241 https://news.ycombinator.com/item?id=21383241 Happy to see it's going mainstream. I'm hopeful that iOS 14 will provide a way to limit this behavior on a per-app basis.

teekert 6y ago

My bank (bunq) offers me to pay the iban (european bank account number) as soon as I open the app with an iban on te clipboard. That's the same, isn't it?

giarc 6y ago
In the twitter video Tik Tok is pasting from Instagram though. I also don't know why Tik Tok would be looking for text on the clipboard (to be fair I've never used Tik Tok though).

dreamcompiler 6y ago

TikTok is known to be Chinese malware. Is anybody on HN surprised by this? https://www.military.com/daily-news/2019/12/30/army-follows-pentagon-guidance-bans-chinese-owned-tiktok-app.html https://www.military.com/daily-news/2019/12/30/army-follows-...

kpennell 6y ago
I know this and I get it....but damn it's so much more entertaining than Instagram now. The content is more varied, more raw, and the for you page filtering is so well-tailored.

kinnth 6y ago

Is it even clear whether this data is being sent back to Tiktok or any company or is it simply to check for activating keywords to add app functionality? Is it all done locally?

BFatts 6y ago

I find it interesting that people automatically assume nefarious reasons for accessing the clipboard... If your privacy is so important, don't use platforms you cannot trust. If that means not using a smart phone, then maybe you will do something positive for yourself.

andy_ppp 6y ago

Is there any logical reason to do this apart from harvesting things people have copied. Seems purely evil to me?

feelix 6y ago

if only they'd do this for apps accessing the microphone, or do the same thing as they do with the camera making the application visibly request access

ipiz0618 6y ago

Zoom, WeChat, Weibo has all been exposed of sending users' data back to Chinese servers. Why would TikTok be different? It's already alarming enough that a Chinese social media app is at the top of the App Store. People need to learn to stop trusting these apps.

nerdjon 6y ago

Woke up this morning thinking... There is a part of me that is little sad Apple did not just wait to add this feature until iOS 14 released or one of the last GM's. If only because it would be a huge wakeup call for users about what their apps are doing and possibly collecting, instead of it all being patched out now. Instead we are seeing basically no traction on this outside of tech circles.

vecio 6y ago

TikTok and many popular Chinese apps, including Taobao, Baidu, and Alipay, to name a few, snoop clipboard contents, because Tencent censors and forbids almost all kind of links sharing in WeChat and QQ. https://news.ycombinator.com/item?id=23654345 https://news.ycombinator.com/item?id=23654345

NN88 6y ago

Apple is really setting the tone.