8 ms·

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboa

I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code. Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

radomysisky 6y ago
Should we still be giving the benefit of the doubt to a Chinese-owned honeypot in 2020?
- sgjohnson 6y ago
  Absolutely not.
tempestn 6y ago
You'd think if the user knew to copy a tracking code into their clipboard, they could also paste it into the appropriate field without the app needing to extract it for them. Edit: fair responses, all. You've convinced me.
- mkenyon 6y ago
  I mean, sure, you're technically correct, but you're missing the point. For just one example, it's so heckin' convenient when an app recognizes that you have a 2FA token in your clipboard copied from your 2FA app and "pastes" it for you automatically.
- the_pwner224 6y ago
  Not having to paste is very useful. Especially on mobile where pasting is slow and tedious. A few months ago I would have said the same thing as you, but then I experienced some applications which looked at what I had copied and automatically did all the hard work. It's a pleasant surprise to see it happen, and having experienced it, I am happy that the applications have this functionality. Of course if you're living in a world where all the code on your device is considered hostile, then you may not want this. But I use almost only free software and there you can generally start with a presumption of goodwill instead of starting with a feeling of distrust, like with TikTok.
- jdminhbg 6y ago
  Yes, but this is still convenient. For example, Pocket (a read-it-later service) checks your clipboard when you open the app. Normally to add a new URL to your reading list, you need to tap through a menu or two from the front page of the app. But if it detects your clipboard has a URL on it, it provides a small one-tap "Add this copied URL to your list?" button at the bottom of the screen, reducing the friction.
- binarycrusader 6y ago
  Google/Apple maps does this too; if you've copied an address and then open them it offers you the copied address as a suggestion (usually with a clipboard icon) or as an option to navigate to instead of having to copy/paste manually.
reaperducer 6y ago
I use a shipping app that does that. Doesn't the shipping app know when it's newly in focus, and shouldn't it only then check the clipboard, not constantly check? FWIW, the one I use only checks once — upon startup. It's sometimes annoying that I have to kick it out and re-launch if I've copied a tracking URL from e-mail after the delivery tracking app is already open, but now that I know that's the price of privacy, I'm perfectly OK with it.
derimagia 6y ago
I know in some apps when logging in with a TOTP (2-factor auth code) it scans your clipboard for it. I believe Slack was one of these. I thought it was useful at the time.
skunkworker 6y ago
Deliveries on my iPhone does this. Though I’m pretty sure if apple opened up a API that would allow you to provide a hard coded Regex it would solve a number of privacy issues.
patrickyeon 6y ago
I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input field? Is it that much to ask that you find the least offensive way to serve your user? On the other hand, what will you lose when the news gets out that you've created a keylogger? What about when someone else at your company pushes you to monitor for something else for strategic advantages? Or what about when another developer doesn't understand the implications and now your app is responsible for revealing passwords or other sensitive information? Are all of these worth saving one click?
- greggman3 6y ago
  This is a OS bug not an app bug. You can't expect millions of app developers to get this right. An app should not be allowed to read the clipboard until a user chooses to "paste". That's on the OS for allowing this behavior. It's silly to think that making it possible to read the clipboard at any time that some how all millions of app developers will use it correctly even if they have no malicious intent.
  - 013a 6y ago
    A high speed collision happens on a freeway, killing both drivers. This is a car manufacturer bug, not a human bug. You can't expect millions of drivers to get driving right. A car should not be allowed to drive fast. How about: stop apologizing for billion dollar corporations. Fault can be placed on both the OS and applications. I expect better, from everyone.
    - greggman3 6y ago
      The difference is one problem is trivially solvable. If an app isn't allowed to read the clipboard the problem is solved. Smart people choose solutions that actually solve the issue when those solutions exist rather than just making some guideline and praying people read it.
pavel_lishin 6y ago
> Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard. If I find someone digging through my mailbox, I don't start rationalizing their reasons for it - I ask them to explain themselves, and that explanation had better fucking be a good one.
- speedyapoc 6y ago
  For sure. I am not in a position to determine whether TikTok is looking at clipboard contents for good or evil. I simply wanted to point out that there exist innocent reasons for looking at the clipboard.
  - manicdee 6y ago
    The argument is that there is no innocent reason to be looking at the clipboard. Either the user is going to paste the thing in your app ormit’s not yours to fiddle with in the first place. I copy passwords from a password vault. I don’t want your app knowing that I just opened Hacker News five seconds ago and have this password-looking text in the clipboard.
cactus2093 6y ago
This is exactly why I am happy to see Apple cracking down more. I will grant you that this could very much be "innocent", but it's still completely unacceptable to me as a user. And just about every PM or founder I've ever worked with seems to think like this - when given the choice between the straightforward, obvious way to do something, and some crazy, brittle, privacy-abusing hack that might improve conversion by 5%, they'll choose the latter every time. This is a perfect example of this kind of thing, "let's just check the contents of the clipboard every 2 seconds in case the user doesn't know how to paste." It might have even been born out of real complaints from a fraction of users who really can't figure out how to paste. And somewhat depressingly, in the defense of PMs it does actually seem to work sometimes and improve conversions. And all your competitors are probably doing it already anyway. So the only way to stop this crap is for the platform itself to step in. Another example that's also fixed in iOS 14 - Apple already provides a perfectly usable share sheet for choosing a photo, where I can look through my whole phone and pick just a single photo to give to the app. But for some crazy reason, seemingly every app wants to recreate this themselves. So they require you to give them access to your entire photo album so that they can display it back to you with a marginally different design and a different color background than the default page. Now in iOS 14, Apple is giving the user an option to just pick individual photos to share anyway, and then presumably make it appear to the app that those are all the photos you have on your phone. Two very welcome improvements IMO.
- AlexandrB 6y ago
  The mentioned photo change sounds awesome! I was not aware of this iOS 14 feature. Giving an app access to my entire photo album always seemed overly broad, especially given that photo EXIF data can give away other details like location.
- thewebcount 6y ago
  Oh man, that's awesome! I wish they'd do the same thing for contacts. There are a bunch of messaging apps that "need" access to every contact in your phone. I have 1 friend using their service, I don't want to give them access to my other contacts. So I don't use that app. But if I could restrict them to only the one contact I care about, I'd probably use them.
elwell 6y ago
Google Maps does this, and it saves a couple taps. If you have an address on your clipboard and then tap on the address input it will be the first suggested result.
dmonitor 6y ago
Chrome accesses the clipboard every time you touch the address bar to check if you have a URL to go to. Safari does the same, but without a pop up. Apple must be cheating somehow because even they know how annoying it is.
mFixman 6y ago
For that use case, it makes sense for an app to read the clipboard when it's in the Foreground. I cannot think of a single good use case of a background app reading the clipboard like TikTok is doing in this link.

radomysisky 6y ago

Should we still be giving the benefit of the doubt to a Chinese-owned honeypot in 2020?

sgjohnson 6y ago
Absolutely not.

tempestn 6y ago

You'd think if the user knew to copy a tracking code into their clipboard, they could also paste it into the appropriate field without the app needing to extract it for them. Edit: fair responses, all. You've convinced me.

mkenyon 6y ago
I mean, sure, you're technically correct, but you're missing the point. For just one example, it's so heckin' convenient when an app recognizes that you have a 2FA token in your clipboard copied from your 2FA app and "pastes" it for you automatically.
the_pwner224 6y ago
Not having to paste is very useful. Especially on mobile where pasting is slow and tedious. A few months ago I would have said the same thing as you, but then I experienced some applications which looked at what I had copied and automatically did all the hard work. It's a pleasant surprise to see it happen, and having experienced it, I am happy that the applications have this functionality. Of course if you're living in a world where all the code on your device is considered hostile, then you may not want this. But I use almost only free software and there you can generally start with a presumption of goodwill instead of starting with a feeling of distrust, like with TikTok.
jdminhbg 6y ago
Yes, but this is still convenient. For example, Pocket (a read-it-later service) checks your clipboard when you open the app. Normally to add a new URL to your reading list, you need to tap through a menu or two from the front page of the app. But if it detects your clipboard has a URL on it, it provides a small one-tap "Add this copied URL to your list?" button at the bottom of the screen, reducing the friction.
binarycrusader 6y ago
Google/Apple maps does this too; if you've copied an address and then open them it offers you the copied address as a suggestion (usually with a clipboard icon) or as an option to navigate to instead of having to copy/paste manually.

reaperducer 6y ago

I use a shipping app that does that. Doesn't the shipping app know when it's newly in focus, and shouldn't it only then check the clipboard, not constantly check? FWIW, the one I use only checks once — upon startup. It's sometimes annoying that I have to kick it out and re-launch if I've copied a tracking URL from e-mail after the delivery tracking app is already open, but now that I know that's the price of privacy, I'm perfectly OK with it.

derimagia 6y ago

I know in some apps when logging in with a TOTP (2-factor auth code) it scans your clipboard for it. I believe Slack was one of these. I thought it was useful at the time.

skunkworker 6y ago

Deliveries on my iPhone does this. Though I’m pretty sure if apple opened up a API that would allow you to provide a hard coded Regex it would solve a number of privacy issues.

patrickyeon 6y ago

I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it." Even if you're only looking for a shipping tracking number and then only so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input field? Is it that much to ask that you find the least offensive way to serve your user? On the other hand, what will you lose when the news gets out that you've created a keylogger? What about when someone else at your company pushes you to monitor for something else for strategic advantages? Or what about when another developer doesn't understand the implications and now your app is responsible for revealing passwords or other sensitive information? Are all of these worth saving one click?

greggman3 6y ago
This is a OS bug not an app bug. You can't expect millions of app developers to get this right. An app should not be allowed to read the clipboard until a user chooses to "paste". That's on the OS for allowing this behavior. It's silly to think that making it possible to read the clipboard at any time that some how all millions of app developers will use it correctly even if they have no malicious intent.
- 013a 6y ago
  A high speed collision happens on a freeway, killing both drivers. This is a car manufacturer bug, not a human bug. You can't expect millions of drivers to get driving right. A car should not be allowed to drive fast. How about: stop apologizing for billion dollar corporations. Fault can be placed on both the OS and applications. I expect better, from everyone.
  - greggman3 6y ago
    The difference is one problem is trivially solvable. If an app isn't allowed to read the clipboard the problem is solved. Smart people choose solutions that actually solve the issue when those solutions exist rather than just making some guideline and praying people read it.

pavel_lishin 6y ago

> Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard. If I find someone digging through my mailbox, I don't start rationalizing their reasons for it - I ask them to explain themselves, and that explanation had better fucking be a good one.

speedyapoc 6y ago
For sure. I am not in a position to determine whether TikTok is looking at clipboard contents for good or evil. I simply wanted to point out that there exist innocent reasons for looking at the clipboard.
- manicdee 6y ago
  The argument is that there is no innocent reason to be looking at the clipboard. Either the user is going to paste the thing in your app ormit’s not yours to fiddle with in the first place. I copy passwords from a password vault. I don’t want your app knowing that I just opened Hacker News five seconds ago and have this password-looking text in the clipboard.

cactus2093 6y ago

This is exactly why I am happy to see Apple cracking down more. I will grant you that this could very much be "innocent", but it's still completely unacceptable to me as a user. And just about every PM or founder I've ever worked with seems to think like this - when given the choice between the straightforward, obvious way to do something, and some crazy, brittle, privacy-abusing hack that might improve conversion by 5%, they'll choose the latter every time. This is a perfect example of this kind of thing, "let's just check the contents of the clipboard every 2 seconds in case the user doesn't know how to paste." It might have even been born out of real complaints from a fraction of users who really can't figure out how to paste. And somewhat depressingly, in the defense of PMs it does actually seem to work sometimes and improve conversions. And all your competitors are probably doing it already anyway. So the only way to stop this crap is for the platform itself to step in. Another example that's also fixed in iOS 14 - Apple already provides a perfectly usable share sheet for choosing a photo, where I can look through my whole phone and pick just a single photo to give to the app. But for some crazy reason, seemingly every app wants to recreate this themselves. So they require you to give them access to your entire photo album so that they can display it back to you with a marginally different design and a different color background than the default page. Now in iOS 14, Apple is giving the user an option to just pick individual photos to share anyway, and then presumably make it appear to the app that those are all the photos you have on your phone. Two very welcome improvements IMO.

AlexandrB 6y ago
The mentioned photo change sounds awesome! I was not aware of this iOS 14 feature. Giving an app access to my entire photo album always seemed overly broad, especially given that photo EXIF data can give away other details like location.
thewebcount 6y ago
Oh man, that's awesome! I wish they'd do the same thing for contacts. There are a bunch of messaging apps that "need" access to every contact in your phone. I have 1 friend using their service, I don't want to give them access to my other contacts. So I don't use that app. But if I could restrict them to only the one contact I care about, I'd probably use them.

elwell 6y ago

Google Maps does this, and it saves a couple taps. If you have an address on your clipboard and then tap on the address input it will be the first suggested result.

dmonitor 6y ago

Chrome accesses the clipboard every time you touch the address bar to check if you have a URL to go to. Safari does the same, but without a pop up. Apple must be cheating somehow because even they know how annoying it is.

mFixman 6y ago

For that use case, it makes sense for an app to read the clipboard when it's in the Foreground. I cannot think of a single good use case of a background app reading the clipboard like TikTok is doing in this link.