19 ms·

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this

It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/ https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...)

alfalfasprout 6y ago
People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.
- dheera 6y ago
  I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy. Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly. For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of luck and can only just choose to not use the app. On Android (by modifying the OS) you can actually send back fake IMU data to make the app think it got the permissions it wanted but really didn't. Or you can let access to your photos, but only let it see a walled garden of a few select photos.
  - Skunkleton 6y ago
    You're right, but you are also missing the point. Consumers in general have access to one of only a few options for computing tasks. To date, of these mainstream options, only Apple is taking a meaningful stance on privacy. Is it self-serving, sub-optimal, or otherwise broken? Probably. Is it the best thing for privacy currently widely available? Probably.
  - meesles 6y ago
    Homebrew software and hacks aren't feasible solutions for the general population. You can't expect a tech-illiterate person to put up with all of that to protect their right to privacy. Like it or not, solutions like Apples' are much more efficient at protecting 1 billion (exaggeration) people at once.
    - jdxcode 6y ago
      I'm not even sure how something like T2 could be done with an open platform
      - 7786655 6y ago
        Let the user replace the manufacturer's keys with their own?
        rimjongun 6y ago
        Imagine grandma accidentally putting her phone number in instead of an encryption key.
        chacha2 6y ago
        Imagine grandma going for a drive by shooting with her AK
    - bobthechef 6y ago
      Not just illiterate. How many people here have the time or desire to inspect every app they use? It's a ridiculous proposition. We all have better things to do.
      - andrepd 6y ago
        Obviously the onus isn't on every single user to single handedly verify themselves that the software is correct. Do you check your government's finances yourself? So why should they even publish it? By your logic, that is. The answer is that if it's open then multiple people with differing interests, such as competitors, or even independent organisations such as non-profit auditors, can check the code.
  - czzr 6y ago
    > On Android (by modifying the OS) I’m genuinely curious how you can imagine this is a realistic solution.
    - shawnz 6y ago
      Developers could create a third party ROM with the privacy enhancements which users could install.
      - TheOtherHobbes 6y ago
        How is users having to trust third-party developers about privacy features in a ROM different to users having to trust Apple?
        lwhi 6y ago
        Android is open source, iOS is not.
        rootusrootus 6y ago
        The Android almost everyone uses is not open source.
        lwhi 6y ago
        The iOS _everyone_ uses is not open source.
        shawnz 6y ago
        Independent audits could be conducted on those privacy enhanced ROMs, if there was enough interest. I'm not saying this is the most practical solution to this problem but at least it's a possibility.
        realusername 6y ago
        Anybody can have a look at the ROM to see if it makes sense whereas only Apple can realistically audit the iPhone.
  - unityByFreedom 6y ago
    > this still doesn't solve the problem of whether Apple themselves are abusing your privacy Eventually you have to trust someone. This added transparency from Apple is commendable. I support open source for publicly funded software, but if it's privately owned and funded, you can choose to buy and use it or not. Private companies are not under any moral obligation to open source their code or methods. Some people are successful while open sourcing everything, and that is commendable too.
    - lwhi 6y ago
      Why do you have to eventually trust someone?
      - kingnight 6y ago
        Because you would need to write and/or audit your entire technology toolchain — software, build tools, operating systems, hardware, etc — which isn't feasible for anyone.
        the_gipsy 6y ago
        not a single person, but the sum of all people looking at the different parts. that's how open source works.
        dkonofalski 6y ago
        Sure, but then you're putting your trust in those people. The point was that an individual can't possibly have the time or resources to do it themselves and so, at some point, they have to put their trust in someone else.
        baddox 6y ago
        And thus you would need to trust those people.
        gggmaster 6y ago
  - Polylactic_acid 6y ago
    I hate how our options are "Choose apple and blindly trust them" or "Chose android an see in the open that your data is being abused"
    - andrepd 6y ago
      You forgot option 3: use Lineage+microg and enjoy the most private and secure platform available on a smartphone today. But if you chose the first one then you can't, because apple won't let you choose the software that runs on the equipment you bought.
      - Polylactic_acid 6y ago
        I used to use linageOS no gapps and I loved it but then my nexus 5x died and I got a pixel 2 and linageOS support stopped at the pixel 1. It seems to me that the age of custom roms is over. Android got good enough that the only reason for a custom rom was privacy and extended updates. Since the pixel 2 is still updated there is no reason other than privacy and I guess no one was willing to put in the work for just that.
        efreak 6y ago
        > Since the pixel 2 is still updated there is no reason other than privacy Features. - The ability to run Android without Google. - The ability to change the location of your clock. - The ability to have some apps open with the status bar and navbar and some not. - The ability to change your WiFi network without opening settings (yes, I'm still upset they removed that. I use an Android 8 tablet daily, so I'm unlikely to forget). - Adding invisible left/right dpad buttons and a menu button in my navbar. - Change the number of quick settings. - Change the screen dpi (this is implemented these days, I think, but only with 3-5 settings available) - use adb without first plugging into a computer. Maybe I'm going somewhere and I'll need to restart my phone. - run Linux in a chroot (far better than proot) - install Fdroid privileged extension without losing access to security updates. You can say full well that you don't care about these, you don't have to care. However, these are all things that you can't do without an alternative ROM (or without rooting, which loses access to updates).
  - danielpyon 6y ago
    I don't understand why this is controversial: companies will continue to abuse us so long as there is a profit incentive to do so.
  - arkades 6y ago
    Apple’s approach improves privacy in most contexts for all of its users, enough to shape market practices. Your approach works for a tiny, tiny sliver of people - which, by the nature of population-level snooping and marketing, are irrelevant.
  - RandomBacon 6y ago
    > I'm probably going to get downvoted to hell It's a self-fulfilling prophecy. Don't bring it up next time. Reverse psychology (in an attempt to not get downvotes) doesn't work here, it just pisses people off (and is against the rules to complain about), so you WILL receive downvotes for mentioning it.
    - dheera 6y ago
      It happens whether or not I say that actually. Every time I disagree with Apple I get downvoted to oblivion. There are just too many Apple fanboys here who believe Apple is the be-all end-all of everything privacy.
      - sbuk 6y ago
        Or what you’re saying doesn’t add to the conversation. Simply blaming ‘fanboys’ isn’t useful. I don’t think any of the responses to you post believe that Apple are the “be-all end-all” of privacy, but they are arguing that for the typical consumer (something that is too often overlooked) they currently provide the best solution available. The critical bit there is typical consumer. If you’re a “power user” (what a horrid expression) and want to go another route, have at it! You have a choice.
  - threeseed 6y ago
    > Or you can let access to your photos, but only let it see a walled garden of a few select photos. iOS 14 has this now. And any access to sensitive data always prompts you. And if you deny the request it sends empty data back to the app. Exactly like what you describe.
    - dheera 6y ago
      Yes but you could do this on Android since version 1 because it was open source. You could always modify the OS to spit out fake sensor data and appease apps that would otherwise not run if you didn't give them permissions. My privacy shouldn't depend on Tim Cook's product management timeline.
- shawnz 6y ago
  Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.
  - patrickyeon 6y ago
    I've only ever been an Android user, but for a while I was paying a lot of attention to iOS too. It seems to me like they've been back and forthing, as one side figures out some improvements, the other side more-or-less re-implements them on their next release with their own unrelated improvements. Seems like a good thing, really.
    - dylan604 6y ago
      Not being an Android user, one of the negatives that was often talked about (maybe no longer true?) is that a lot of phones could not upgrade to new versions of Android. Is that still a thing, or was that limited to the lower tier phones?
      - tedivm 6y ago
        It's definitely still a thing, as android updates are normally pushed by the manufacturers. The Android One phones are an exception to this.
        bchanudet 6y ago
        Updates are still pushed by the manufacturer. I have the Xiaomi Mi A2 Lite (with Android One) and only got Android 10 last week. Biggest advantage is that it's a pure Android with no bloatware from the manufacturer. Also you get a guarantee IIRC to have at least two versions upgrades for the phone (my Xiaomi came with Android 8, so 10 should be the last one), and most of all security updates.
        abakker 6y ago
- untog 6y ago
  Yes and no: they still allowed developers to do it for a very long time. I remember years ago when a social app was chastised for uploading your entire contact book to their servers without asking, because at the time there was no permission barrier for it. In this instance, apps have been doing this for years. Apple knows this. It’s not entirely clear why they only decided to act on it now.
- andrepd 6y ago
  No, you're really only transferring the trust onto Apple.
  - chongli 6y ago
    And that's the dilemma of our society. How do we trust all these people and big companies we don't know? Maybe we can't! It seems like an intractable problem but I think we still have a few tricks up our sleeves. For one thing, we can look at what public companies report in their quarterly earnings and what major business decisions they make. For Apple, the vast majority of their revenue comes from hardware and services. A very, very tiny amount of their revenue comes from advertising. Compare that with Google and Facebook. These companies make nearly all of their revenue from advertising. Why is this distinction important? Because advertising is all about data collection. Hardware sales? Much less so. So when I need to figure out whether I should trust Apple vs trusting Google, I look at where their incentives are and how much they align with my own. Google's incentive is to collect as much of my data as possible and monetize it while keeping me engaged with search and YouTube. Apple's incentive, on the other hand, is to sell me new hardware and get me to subscribe to their services. It seems pretty clear to me that Apple has far less incentive to snoop on my personal data and abuse my privacy than Google does, so I deem them more trustworthy. Is this a complete picture? Probably not. But I think it's still a valuable one.
- swiley 6y ago
  It’s nice if you’re coming from something like windows where everything is closed and often maintained by an organization. Coming from GNU/Linux where most things are open and community maintained it’s definitely a step backwards.
- greggman3 6y ago
  The walled garden does no such thing. Either iOS is secure or it's not. if it's secure there is no need for the walled garden. Let me run anything and trust its security. If it's not secure then the walled garden is security theater because it's trivial for any app to hide its true intent.
  - jetpks 6y ago
    > Either iOS is secure or it's not This is flat out wrong. Security isn't binary.
    - greggman3 6y ago
      It's not wrong. Browsers don't have a walled garden. They just try to be secure period. Apple's fictions is their walled garden saves you from bad apps. It doesn't. There have been and will be plenty of bad apps. A secure platform saves you from bad apps, period.
      - SAI_Peregrinus 6y ago
        You're both right. The walled garden has nothing to do with security, AND security isn't binary.
        rimliu 6y ago
        So walls and fences have nothing to do with security? Interesting. I will even say, world-shattering news.
        VonGallifrey 6y ago
        Yes. First of because "walled garden" is just a metaphor for the type of system the App store represents and Second if you have "walls and fences" but with an open door where everyone can enter if they Pay 30% of their revenue then those walls are there for revenue generation and not for security.
      - 6y ago
- p1necone 6y ago
  Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.
  - HeadsUpHigh 6y ago
    Ah yes permissions: "-This clock app needs to access your photos, contacts, all the hardware the phone has and all your cloud accounts -No -The app can not function without the required permissions."
    - kabacha 6y ago
      Yes and the app gets uninstalled and review bombed on google's play store. Seems like a successful democratic process to me.
      - la_oveja 6y ago
        >App steals data from millions >Gets catched years later and review bombed >Author walks away with pockets full and probably onto the next money-grabbing project Oh yes, classic "successful democratic process"
        kabacha 6y ago
        That's a bit of a stretch. On play store permission bombing is so prevalent and no one is installing any apps with less than 4 stars so I doubt the "malware" makes enough money to sustain this.
      - HeadsUpHigh 6y ago
        Time to make a new clock/flashlight/garbage game app I guess!!!
  - DaiPlusPlus 6y ago
    Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies](https://blog.codinghorror.com/the-dancing-bunnies-problem/ https://blog.codinghorror.com/the-dancing-bunnies-problem/). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loading or alternative app-stores (with looser auditing) means they’re forced to comply with Apple’s regs against unnecessary permission prompts, and this means they simply can’t take advantage of users’ ignorance (or overriding desire to see the dancing bunnies) to get them to grant unnecessary permissions.
- jacobsenscott 6y ago
  There was a time when people could run opensource software on their primary computing device, and total privacy control was available immediately, and not dolled out and taken away at the whims of their corporate overlords. Apple has done more to kill opensource, and thus eliminate privacy, than any other company in the history of computing.
- musha68k 6y ago
  Do you know if the new ios will bring back (?) fine grain controls over microphone access? You can either give rights to an app for access or no access at all, which is really bad and IIRC through the "while using only" option in ios versions before was more respecting of customer privacy. If Apple removed granular mic controls before the current ios version, I really don't understand why.
  - arrrg 6y ago
    What iOS 14 does is it shows you a dot in the status bar when either the camera or microphone is used (with different colors for each). In Control Center it will also show you which App recently used those. So that’s not more fine grained control, but it can help you understand when someone is abusing the permission.
    - musha68k 6y ago
      Thanks! I've asked in the twitter thread if early adopters of iOS 14 could also check if any apps access the microphone while in background (even though they shouldn't have to by use case). I have the suspicion that some apps listen into conversations to apply speech recognition and NLP for targeted ads and maybe even more malicious practices - though I'm guessing networks close to FB for example would have been smart enough to have turned off those "features" for their apps by now but maybe not. Still, it would be interesting: https://twitter.com/musha68k/status/1276112945496428544?s=21 https://twitter.com/musha68k/status/1276112945496428544?s=21
- dzhiurgis 6y ago
  How is that Apple didn't catch TikTok doing this way way earlier to give them some sort of penalty.
  - abc-xyz 6y ago
    Maybe the Chinese government forced Apple the same way that they’re forcing them to secretly share [Chinese] users [in China] most sensitive data with the government (photos, videos, notes and everything automatically backed up by iCloud).
    - sbuk 6y ago
      You do know that iCloud isn’t owned or operated by Apple in China? Much like Microsoft/Office 365, it’s owned and operated by a state owned business. This is true of a lot of large cloud services that run in China. I’m not saying it’s any better, or indeed worse, rather it’s an important distinction.
      - abc-xyz 6y ago
        I do and I don’t think it’s an important distinction at all. That being said, I of course know that the Chinese government didn’t force Apple to implement this privacy violating feature, and I know that the Chinese government didn’t force Apple to allow TikTok to abuse it. But many people see Apple as a privacy conscious company thanks to its marketing, and its good to remind people that for Apple, privacy is simply a marketing gimmick.
  - croes 6y ago
    Maybe because a lot of Apps are doing that and it's not a special bevaviour of TikTok
- WA 6y ago
  I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta data", but this would break the integration of Contacts in other Apple products. 2. Photos. It is either full access or no access. For example, I don’t trust WhatsApp. I share photos through WhatsApp by opening the Photos app, tap share, share via WhatsApp. This works okay. But generally speaking: why can’t Contacts and Photos have the same sophisticated access control system like Health? Heck, make it optional for iPhone users, but at least offer it.
  - doctor_eval 6y ago
    iOS 14 allows sharing specific photos: https://www.macrumors.com/2020/06/24/ios-14-users-give-apps-access-select-photos/ https://www.macrumors.com/2020/06/24/ios-14-users-give-apps-... Maybe contacts too, but I haven’t read that anywhere.
  - tomduncalf 6y ago
    Looks like photos is addressed in iOS 14 https://appleinsider.com/articles/20/06/24/apple-fine-tunes-photos-privacy-in-ios-14-to-tailor-access-to-specific-images https://appleinsider.com/articles/20/06/24/apple-fine-tunes-... Agree tighter control over contacts sharing would be nice but I don’t think it’s malicious on Apple’s part that this isn’t possible - they’ve quite clearly shown they are on the side of user privacy, but they do also tend to move at a fairly slow pace
    - WA 6y ago
      That is incredibly good news, thanks for the link.
    - lifeisstillgood 6y ago
      The choice of only allowing access to specific actual photos seems an unusual one. I would have thought there was a big debate in Product Mgmt over this vs the more obvious allow an app access to a given album. One presumes the sticking point came when someone took a photo out of an album. Does that mean they are explicitly removing access? I don't see it as a huge issue... maybe there is some kind of technical hurdle involved as well, otherwise the choice seems unusual
- DyslexicAtheist 6y ago
  rubbish. if Apple allowed proper introspection this would have been discovered months ago and not just in the latest iOS release.
- z3t4 6y ago
  Why not give user the option to chose another app store? There could be many stores like in Ubuntu.
  - neop1x 6y ago
    Because 30% cut from every app is worth squeezin$.
- amelius 6y ago
  > but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. On Linux and BSD we've been having very good privacy features for years now. Therefore I don't think that privacy is at the top of the list of Apple's motives.
- m4rtink 6y ago
  So then why people can't run their hand inspected code on their iOS devices they own ? Why can't people run good privacy respecting GPLv3 licensed applications ? The walled garden actually makes it harder to run software you and others can check to be sucure, instead you have to depend on some opaque QA somewhere in Apple to check that for you. Not to mention you can't elect to use software that has features blocked by default for security reasons where you are sure it will not misuse them as you have audited the source (or even written it yourself!).
  - Moru 6y ago
    That's not what iPhones are for. The android market is more for the tinkerer historically, Apple is just supposed to work the way it was intended, always was that way. Android is moving that direction too so not sure what to choose now?
    - m4rtink 6y ago
      Well, I have never used Android or iOS on my primary mobile device - went directly from cell phone to Maemo on Nokia N900, then MeeGo on Nokia N9 to Sailfish OS where I am to this day, running Sailfiosh OS on supported Xperia devices. Hopefully, with reasonably open mobile hardware (PinePhone) other open mobile OS efforts will get more traction now, as the main obstacle of mobile OS development to this day has always been closed hardware & all the crapy proprietary software bundled with it.
jedieaston 6y ago
1Password grabs the clipboard whenever I open the app, whether or not I'm even in a text field. Can't think of why it needs to do that..
- jdxcode 6y ago
  my guess is that it's checking to see if it can clear the clipboard or if you copied something else
- joshstrange 6y ago
  I wonder if it so they can restore the keyboard when you copy a password? I know they could copy it at time of copy as well but just a thought.
- untog 6y ago
  It’s for two factor auth tokens. When I fill in a password it copies my two factor code to the clipboard, then ~30 seconds later it restores the original clipboard content. All pretty silly all things considered but I can’t think of an easier way to do things.
- avianlyric 6y ago
  The app does a check for URLs and will offer to open the URL using its own browser if it detects one. Reading around it looks like there are better APIs for doing this, where you can ask iOS is the clipboard contains a string matching a pattern, which actually getting access to the content.
unityByFreedom 6y ago
Do these other apps do it for every keystroke? Do TikTok's competitors, other popular social media apps, do this?
mrtksn 6y ago
>It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo Okay, this could be simply a dynamic link library checking for a deep link in the clipboard. Why do this? To preserve the state after install. Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen. The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session. Of course, with iOS 14 the best practice would be to do this only once after the install.
- just-ok 6y ago
  That's all well and good, but as a privacy-conscious user I still want to (a) know about it and (b) be able to control/disable it.
- madeofpalk 6y ago
  Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!
  - BoorishBears 6y ago
    ... what? Yes? That's the definition of a deep link? The way you get notified is you open their app... This is a special case when you don't already have the app installed, but being able to read the clipboard without warning is it's own thing, but this specific deep link use-case is extremely benign...
    - just-ok 6y ago
      Ideally, we’d be able to differentiate between local parsing (which I’d deem acceptable) and a remote request, but that quickly enters a gray area. How long after parsing do we validate a request? Is it even viable for a compiler to track the status of a property beyond assignment? And for how long? etc.
trangon 6y ago
How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes? It’s disappointing to see the lack of skepticism applied on a site like Hacker News.
- pedrovhb 6y ago
  What's a legitimate, non-nefarious reason for an app to do that?
  - mrtksn 6y ago
    Session restoration after install. Explained here: https://news.ycombinator.com/item?id=23635223 https://news.ycombinator.com/item?id=23635223
  - shalmanese 6y ago
    The maker of the Apollo Reddit app chimed in on the reddit thread that his app would check to see if a reddit URL was in the clipboard and offer to take you to that page. Chrome uses it so the URL appears when you select the address bar.
    - lostmsu 6y ago
      Sounds like Chrome doesn't do it in background.
  - filleduchaos 6y ago
    The contents of your clipboard _can_ be directly related to the functionality of an app. For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?"). Whether or not the convenience is worth it might be debatable, but I fail to see how one would call that nefarious.
madeofpalk 6y ago
In that Reddit thread the author of a Reddit app mentions that they look at the clipboard to see if you have a Reddit link, and offer to open that page in the app (as iOS offers no better way). On Twitter I saw a. Doing app mention they trigger the notification on every key press because they have custom ‘paste’ button that only shows when you have something copied.
- robinson7d 6y ago
  Sounds like that’s the Apollo app. It’s a pretty nice feature but I find it only seems to work for me when I open the app, so I have to force close it. There’s probably a button for it somewhere, but having one on the home page (or similar) seems like it would be equally good or better UX while also getting the users consent to read their clipboard (since they’re clicking the button). Really nice app in general though.
- blisseyGo 6y ago
  Yep, for Apollo app, it makes sense why he does it. But for other apps like TikTok, it makes no sense. I wonder if the app also sends the clipboard data after that. Someone should look into network requests being made.
  - LordDragonfang 6y ago
    TikTok also has web URLs that they could open in the app, as do many other apps.
    - JimDabell 6y ago
      That’s a different situation though. iOS supports universal links, so a website and iOS application can indicate that when you open a link to the website but have the application installed, the application opens and takes you to the content. This is what TikTok can use to open links to TikTok in the application. But this isn’t a general purpose website => app association. Only the website owner can allow an application to do this. You wouldn’t want, say, Google to set up their application to open DuckDuckGo URLs, for instance. So when it comes to third-party Reddit clients, they can’t automatically open reddit.com URLs because they don’t own reddit.com. The clipboard trick is a workaround for that.
BiteCode_dev 6y ago
"Companies just cannot be trusted with x" has been repeated and repeated for the last decades. I think the conclusion is "Companies just cannot be trusted". At all. With anything. We should assume guilty unless proven overthise for companies. They should go out of their way to show us their good will.
pwdisswordfish2 6y ago
"It seems like a ton of apps are abusing this feature:" Honest question: Why do we need this feature? As a user, I am happy to sacrafice whatever benefit it provides -- to end users -- to stop the abuse. Obviously the feature provides benefits to app developer personal data collectors. OK by me to remove feature.
- Cthulhu_ 6y ago
  I've never seen a "I will paste your clipboard for you" feature be used in any app, ever.
  - eknkc 6y ago
    I like parcel tracking apps detecting a tracking number in clipboard
    - fsflover 6y ago
      Is it also fine that tracking apps read all your passwords in the clipboard?
      - simonklitj 6y ago
        Agreed that this downside is not worth the convenience. But, I think iOS 14 provides a great solution to this problem; you can pattern match against the contents of the clipboard without reading the contents. Then you can always read it if it matches.
  - dmit 6y ago
    A dictionary app I use looks at the clipboard when opened and automatically displays a translation iff 1) the copied text is new compared to the previous time the app was used; and 2) the text is in the source language. It's a pretty neat use of the feature, although I'd still gladly let go of it if it means that the other 20 apps I regularly use don't get to rummage through my clipboard for no good reason.
  - 6y ago
deleted 6y ago
[deleted]
nuker 6y ago
> It seems like a ton of apps are abusing this feature Can they, if Background Refresh is off for the app? I allow it only for Apple apps.
- scarlac 6y ago
  Generally, no. But there are ways for an app to stay active in the background. Some are grounds for App Store suspension. Music playing apps may stay somewhat active in the background. However, I don't know if the clipboard API will still work when an app is in the background.
wrkronmiller 6y ago
Why were this apps approved by the app store?
alpb 6y ago
I have a feeling like many of the apps are reading the clipboard on the launch because they probably act on copied text (e.g. if it's a link or a number, they can use that to show a suggested user action). Obviously I might be wrong, but we live in times where many applications are reverse engineered and their traffic is MITM'ed all the time. I'm not sure if anyone’s sending those clipboard contents outside the device. That would be a problem.

alfalfasprout 6y ago

People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

dheera 6y ago
I'm probably going to get downvoted to hell for saying this (again) but this still doesn't solve the problem of whether Apple themselves are abusing your privacy. Also, the closed-source OS means it's impossible to see what things are doing under the hood, or modify the behavior of the OS itself to be more privacy friendly. For example, on Apple if you aren't happy with an app snooping on your IMU data, you're out of luck and can only just choose to not use the app. On Android (by modifying the OS) you can actually send back fake IMU data to make the app think it got the permissions it wanted but really didn't. Or you can let access to your photos, but only let it see a walled garden of a few select photos.
- Skunkleton 6y ago
  You're right, but you are also missing the point. Consumers in general have access to one of only a few options for computing tasks. To date, of these mainstream options, only Apple is taking a meaningful stance on privacy. Is it self-serving, sub-optimal, or otherwise broken? Probably. Is it the best thing for privacy currently widely available? Probably.
- meesles 6y ago
  Homebrew software and hacks aren't feasible solutions for the general population. You can't expect a tech-illiterate person to put up with all of that to protect their right to privacy. Like it or not, solutions like Apples' are much more efficient at protecting 1 billion (exaggeration) people at once.
  - jdxcode 6y ago
    I'm not even sure how something like T2 could be done with an open platform
    - 7786655 6y ago
      Let the user replace the manufacturer's keys with their own?
      - rimjongun 6y ago
        Imagine grandma accidentally putting her phone number in instead of an encryption key.
        chacha2 6y ago
        Imagine grandma going for a drive by shooting with her AK
  - bobthechef 6y ago
    Not just illiterate. How many people here have the time or desire to inspect every app they use? It's a ridiculous proposition. We all have better things to do.
    - andrepd 6y ago
      Obviously the onus isn't on every single user to single handedly verify themselves that the software is correct. Do you check your government's finances yourself? So why should they even publish it? By your logic, that is. The answer is that if it's open then multiple people with differing interests, such as competitors, or even independent organisations such as non-profit auditors, can check the code.
- czzr 6y ago
  > On Android (by modifying the OS) I’m genuinely curious how you can imagine this is a realistic solution.
  - shawnz 6y ago
    Developers could create a third party ROM with the privacy enhancements which users could install.
    - TheOtherHobbes 6y ago
      How is users having to trust third-party developers about privacy features in a ROM different to users having to trust Apple?
      - lwhi 6y ago
        Android is open source, iOS is not.
        rootusrootus 6y ago
        The Android almost everyone uses is not open source.
        lwhi 6y ago
        The iOS _everyone_ uses is not open source.
      - shawnz 6y ago
        Independent audits could be conducted on those privacy enhanced ROMs, if there was enough interest. I'm not saying this is the most practical solution to this problem but at least it's a possibility.
      - realusername 6y ago
        Anybody can have a look at the ROM to see if it makes sense whereas only Apple can realistically audit the iPhone.
- unityByFreedom 6y ago
  > this still doesn't solve the problem of whether Apple themselves are abusing your privacy Eventually you have to trust someone. This added transparency from Apple is commendable. I support open source for publicly funded software, but if it's privately owned and funded, you can choose to buy and use it or not. Private companies are not under any moral obligation to open source their code or methods. Some people are successful while open sourcing everything, and that is commendable too.
  - lwhi 6y ago
    Why do you have to eventually trust someone?
    - kingnight 6y ago
      Because you would need to write and/or audit your entire technology toolchain — software, build tools, operating systems, hardware, etc — which isn't feasible for anyone.
      - the_gipsy 6y ago
        not a single person, but the sum of all people looking at the different parts. that's how open source works.
        dkonofalski 6y ago
        Sure, but then you're putting your trust in those people. The point was that an individual can't possibly have the time or resources to do it themselves and so, at some point, they have to put their trust in someone else.
        baddox 6y ago
        And thus you would need to trust those people.
        gggmaster 6y ago
- Polylactic_acid 6y ago
  I hate how our options are "Choose apple and blindly trust them" or "Chose android an see in the open that your data is being abused"
  - andrepd 6y ago
    You forgot option 3: use Lineage+microg and enjoy the most private and secure platform available on a smartphone today. But if you chose the first one then you can't, because apple won't let you choose the software that runs on the equipment you bought.
    - Polylactic_acid 6y ago
      I used to use linageOS no gapps and I loved it but then my nexus 5x died and I got a pixel 2 and linageOS support stopped at the pixel 1. It seems to me that the age of custom roms is over. Android got good enough that the only reason for a custom rom was privacy and extended updates. Since the pixel 2 is still updated there is no reason other than privacy and I guess no one was willing to put in the work for just that.
      - efreak 6y ago
        > Since the pixel 2 is still updated there is no reason other than privacy Features. - The ability to run Android without Google. - The ability to change the location of your clock. - The ability to have some apps open with the status bar and navbar and some not. - The ability to change your WiFi network without opening settings (yes, I'm still upset they removed that. I use an Android 8 tablet daily, so I'm unlikely to forget). - Adding invisible left/right dpad buttons and a menu button in my navbar. - Change the number of quick settings. - Change the screen dpi (this is implemented these days, I think, but only with 3-5 settings available) - use adb without first plugging into a computer. Maybe I'm going somewhere and I'll need to restart my phone. - run Linux in a chroot (far better than proot) - install Fdroid privileged extension without losing access to security updates. You can say full well that you don't care about these, you don't have to care. However, these are all things that you can't do without an alternative ROM (or without rooting, which loses access to updates).
- danielpyon 6y ago
  I don't understand why this is controversial: companies will continue to abuse us so long as there is a profit incentive to do so.
- arkades 6y ago
  Apple’s approach improves privacy in most contexts for all of its users, enough to shape market practices. Your approach works for a tiny, tiny sliver of people - which, by the nature of population-level snooping and marketing, are irrelevant.
- RandomBacon 6y ago
  > I'm probably going to get downvoted to hell It's a self-fulfilling prophecy. Don't bring it up next time. Reverse psychology (in an attempt to not get downvotes) doesn't work here, it just pisses people off (and is against the rules to complain about), so you WILL receive downvotes for mentioning it.
  - dheera 6y ago
    It happens whether or not I say that actually. Every time I disagree with Apple I get downvoted to oblivion. There are just too many Apple fanboys here who believe Apple is the be-all end-all of everything privacy.
    - sbuk 6y ago
      Or what you’re saying doesn’t add to the conversation. Simply blaming ‘fanboys’ isn’t useful. I don’t think any of the responses to you post believe that Apple are the “be-all end-all” of privacy, but they are arguing that for the typical consumer (something that is too often overlooked) they currently provide the best solution available. The critical bit there is typical consumer. If you’re a “power user” (what a horrid expression) and want to go another route, have at it! You have a choice.
- threeseed 6y ago
  > Or you can let access to your photos, but only let it see a walled garden of a few select photos. iOS 14 has this now. And any access to sensitive data always prompts you. And if you deny the request it sends empty data back to the app. Exactly like what you describe.
  - dheera 6y ago
    Yes but you could do this on Android since version 1 because it was open source. You could always modify the OS to spit out fake sensor data and appease apps that would otherwise not run if you didn't give them permissions. My privacy shouldn't depend on Tim Cook's product management timeline.
shawnz 6y ago
Android similarly has been continually improving the privacy/permissions model of the OS when it comes to third party apps. I am not sure that Apple has any obvious advantage in that department specifically.
- patrickyeon 6y ago
  I've only ever been an Android user, but for a while I was paying a lot of attention to iOS too. It seems to me like they've been back and forthing, as one side figures out some improvements, the other side more-or-less re-implements them on their next release with their own unrelated improvements. Seems like a good thing, really.
  - dylan604 6y ago
    Not being an Android user, one of the negatives that was often talked about (maybe no longer true?) is that a lot of phones could not upgrade to new versions of Android. Is that still a thing, or was that limited to the lower tier phones?
    - tedivm 6y ago
      It's definitely still a thing, as android updates are normally pushed by the manufacturers. The Android One phones are an exception to this.
      - bchanudet 6y ago
        Updates are still pushed by the manufacturer. I have the Xiaomi Mi A2 Lite (with Android One) and only got Android 10 last week. Biggest advantage is that it's a pure Android with no bloatware from the manufacturer. Also you get a guarantee IIRC to have at least two versions upgrades for the phone (my Xiaomi came with Android 8, so 10 should be the last one), and most of all security updates.
        abakker 6y ago
untog 6y ago
Yes and no: they still allowed developers to do it for a very long time. I remember years ago when a social app was chastised for uploading your entire contact book to their servers without asking, because at the time there was no permission barrier for it. In this instance, apps have been doing this for years. Apple knows this. It’s not entirely clear why they only decided to act on it now.
andrepd 6y ago
No, you're really only transferring the trust onto Apple.
- chongli 6y ago
  And that's the dilemma of our society. How do we trust all these people and big companies we don't know? Maybe we can't! It seems like an intractable problem but I think we still have a few tricks up our sleeves. For one thing, we can look at what public companies report in their quarterly earnings and what major business decisions they make. For Apple, the vast majority of their revenue comes from hardware and services. A very, very tiny amount of their revenue comes from advertising. Compare that with Google and Facebook. These companies make nearly all of their revenue from advertising. Why is this distinction important? Because advertising is all about data collection. Hardware sales? Much less so. So when I need to figure out whether I should trust Apple vs trusting Google, I look at where their incentives are and how much they align with my own. Google's incentive is to collect as much of my data as possible and monetize it while keeping me engaged with search and YouTube. Apple's incentive, on the other hand, is to sell me new hardware and get me to subscribe to their services. It seems pretty clear to me that Apple has far less incentive to snoop on my personal data and abuse my privacy than Google does, so I deem them more trustworthy. Is this a complete picture? Probably not. But I think it's still a valuable one.
swiley 6y ago
It’s nice if you’re coming from something like windows where everything is closed and often maintained by an organization. Coming from GNU/Linux where most things are open and community maintained it’s definitely a step backwards.
greggman3 6y ago
The walled garden does no such thing. Either iOS is secure or it's not. if it's secure there is no need for the walled garden. Let me run anything and trust its security. If it's not secure then the walled garden is security theater because it's trivial for any app to hide its true intent.
- jetpks 6y ago
  > Either iOS is secure or it's not This is flat out wrong. Security isn't binary.
  - greggman3 6y ago
    It's not wrong. Browsers don't have a walled garden. They just try to be secure period. Apple's fictions is their walled garden saves you from bad apps. It doesn't. There have been and will be plenty of bad apps. A secure platform saves you from bad apps, period.
    - SAI_Peregrinus 6y ago
      You're both right. The walled garden has nothing to do with security, AND security isn't binary.
      - rimliu 6y ago
        So walls and fences have nothing to do with security? Interesting. I will even say, world-shattering news.
        VonGallifrey 6y ago
        Yes. First of because "walled garden" is just a metaphor for the type of system the App store represents and Second if you have "walls and fences" but with an open door where everyone can enter if they Pay 30% of their revenue then those walls are there for revenue generation and not for security.
    - 6y ago
p1necone 6y ago
Apples walled garden approach is not necessary for any of this though (nor does it even make it easier). You can introduce sandboxing, fine grained permissions etc without locking devs and consumers into a controlled app store - these are OS features, not app store features.
- HeadsUpHigh 6y ago
  Ah yes permissions: "-This clock app needs to access your photos, contacts, all the hardware the phone has and all your cloud accounts -No -The app can not function without the required permissions."
  - kabacha 6y ago
    Yes and the app gets uninstalled and review bombed on google's play store. Seems like a successful democratic process to me.
    - la_oveja 6y ago
      >App steals data from millions >Gets catched years later and review bombed >Author walks away with pockets full and probably onto the next money-grabbing project Oh yes, classic "successful democratic process"
      - kabacha 6y ago
        That's a bit of a stretch. On play store permission bombing is so prevalent and no one is installing any apps with less than 4 stars so I doubt the "malware" makes enough money to sustain this.
    - HeadsUpHigh 6y ago
      Time to make a new clock/flashlight/garbage game app I guess!!!
- DaiPlusPlus 6y ago
  Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies](https://blog.codinghorror.com/the-dancing-bunnies-problem/ https://blog.codinghorror.com/the-dancing-bunnies-problem/). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loading or alternative app-stores (with looser auditing) means they’re forced to comply with Apple’s regs against unnecessary permission prompts, and this means they simply can’t take advantage of users’ ignorance (or overriding desire to see the dancing bunnies) to get them to grant unnecessary permissions.
jacobsenscott 6y ago
There was a time when people could run opensource software on their primary computing device, and total privacy control was available immediately, and not dolled out and taken away at the whims of their corporate overlords. Apple has done more to kill opensource, and thus eliminate privacy, than any other company in the history of computing.
musha68k 6y ago
Do you know if the new ios will bring back (?) fine grain controls over microphone access? You can either give rights to an app for access or no access at all, which is really bad and IIRC through the "while using only" option in ios versions before was more respecting of customer privacy. If Apple removed granular mic controls before the current ios version, I really don't understand why.
- arrrg 6y ago
  What iOS 14 does is it shows you a dot in the status bar when either the camera or microphone is used (with different colors for each). In Control Center it will also show you which App recently used those. So that’s not more fine grained control, but it can help you understand when someone is abusing the permission.
  - musha68k 6y ago
    Thanks! I've asked in the twitter thread if early adopters of iOS 14 could also check if any apps access the microphone while in background (even though they shouldn't have to by use case). I have the suspicion that some apps listen into conversations to apply speech recognition and NLP for targeted ads and maybe even more malicious practices - though I'm guessing networks close to FB for example would have been smart enough to have turned off those "features" for their apps by now but maybe not. Still, it would be interesting: https://twitter.com/musha68k/status/1276112945496428544?s=21 https://twitter.com/musha68k/status/1276112945496428544?s=21
dzhiurgis 6y ago
How is that Apple didn't catch TikTok doing this way way earlier to give them some sort of penalty.
- abc-xyz 6y ago
  Maybe the Chinese government forced Apple the same way that they’re forcing them to secretly share [Chinese] users [in China] most sensitive data with the government (photos, videos, notes and everything automatically backed up by iCloud).
  - sbuk 6y ago
    You do know that iCloud isn’t owned or operated by Apple in China? Much like Microsoft/Office 365, it’s owned and operated by a state owned business. This is true of a lot of large cloud services that run in China. I’m not saying it’s any better, or indeed worse, rather it’s an important distinction.
    - abc-xyz 6y ago
      I do and I don’t think it’s an important distinction at all. That being said, I of course know that the Chinese government didn’t force Apple to implement this privacy violating feature, and I know that the Chinese government didn’t force Apple to allow TikTok to abuse it. But many people see Apple as a privacy conscious company thanks to its marketing, and its good to remind people that for Apple, privacy is simply a marketing gimmick.
- croes 6y ago
  Maybe because a lot of Apps are doing that and it's not a special bevaviour of TikTok
WA 6y ago
I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released: 1. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don’t need addresses, birthdays and additional notes I put in m contacts. Sure, I could have a separate contacts app with "meta data", but this would break the integration of Contacts in other Apple products. 2. Photos. It is either full access or no access. For example, I don’t trust WhatsApp. I share photos through WhatsApp by opening the Photos app, tap share, share via WhatsApp. This works okay. But generally speaking: why can’t Contacts and Photos have the same sophisticated access control system like Health? Heck, make it optional for iPhone users, but at least offer it.
- doctor_eval 6y ago
  iOS 14 allows sharing specific photos: https://www.macrumors.com/2020/06/24/ios-14-users-give-apps-access-select-photos/ https://www.macrumors.com/2020/06/24/ios-14-users-give-apps-... Maybe contacts too, but I haven’t read that anywhere.
- tomduncalf 6y ago
  Looks like photos is addressed in iOS 14 https://appleinsider.com/articles/20/06/24/apple-fine-tunes-photos-privacy-in-ios-14-to-tailor-access-to-specific-images https://appleinsider.com/articles/20/06/24/apple-fine-tunes-... Agree tighter control over contacts sharing would be nice but I don’t think it’s malicious on Apple’s part that this isn’t possible - they’ve quite clearly shown they are on the side of user privacy, but they do also tend to move at a fairly slow pace
  - WA 6y ago
    That is incredibly good news, thanks for the link.
  - lifeisstillgood 6y ago
    The choice of only allowing access to specific actual photos seems an unusual one. I would have thought there was a big debate in Product Mgmt over this vs the more obvious allow an app access to a given album. One presumes the sticking point came when someone took a photo out of an album. Does that mean they are explicitly removing access? I don't see it as a huge issue... maybe there is some kind of technical hurdle involved as well, otherwise the choice seems unusual
DyslexicAtheist 6y ago
rubbish. if Apple allowed proper introspection this would have been discovered months ago and not just in the latest iOS release.
z3t4 6y ago
Why not give user the option to chose another app store? There could be many stores like in Ubuntu.
- neop1x 6y ago
  Because 30% cut from every app is worth squeezin$.
amelius 6y ago
> but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. On Linux and BSD we've been having very good privacy features for years now. Therefore I don't think that privacy is at the top of the list of Apple's motives.
m4rtink 6y ago
So then why people can't run their hand inspected code on their iOS devices they own ? Why can't people run good privacy respecting GPLv3 licensed applications ? The walled garden actually makes it harder to run software you and others can check to be sucure, instead you have to depend on some opaque QA somewhere in Apple to check that for you. Not to mention you can't elect to use software that has features blocked by default for security reasons where you are sure it will not misuse them as you have audited the source (or even written it yourself!).
- Moru 6y ago
  That's not what iPhones are for. The android market is more for the tinkerer historically, Apple is just supposed to work the way it was intended, always was that way. Android is moving that direction too so not sure what to choose now?
  - m4rtink 6y ago
    Well, I have never used Android or iOS on my primary mobile device - went directly from cell phone to Maemo on Nokia N900, then MeeGo on Nokia N9 to Sailfish OS where I am to this day, running Sailfiosh OS on supported Xperia devices. Hopefully, with reasonably open mobile hardware (PinePhone) other open mobile OS efforts will get more traction now, as the main obstacle of mobile OS development to this day has always been closed hardware & all the crapy proprietary software bundled with it.

jedieaston 6y ago

1Password grabs the clipboard whenever I open the app, whether or not I'm even in a text field. Can't think of why it needs to do that..

jdxcode 6y ago
my guess is that it's checking to see if it can clear the clipboard or if you copied something else
joshstrange 6y ago
I wonder if it so they can restore the keyboard when you copy a password? I know they could copy it at time of copy as well but just a thought.
untog 6y ago
It’s for two factor auth tokens. When I fill in a password it copies my two factor code to the clipboard, then ~30 seconds later it restores the original clipboard content. All pretty silly all things considered but I can’t think of an easier way to do things.
avianlyric 6y ago
The app does a check for URLs and will offer to open the URL using its own browser if it detects one. Reading around it looks like there are better APIs for doing this, where you can ask iOS is the clipboard contains a string matching a pattern, which actually getting access to the content.

unityByFreedom 6y ago

Do these other apps do it for every keystroke? Do TikTok's competitors, other popular social media apps, do this?

mrtksn 6y ago

>It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo Okay, this could be simply a dynamic link library checking for a deep link in the clipboard. Why do this? To preserve the state after install. Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen. The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session. Of course, with iOS 14 the best practice would be to do this only once after the install.

just-ok 6y ago
That's all well and good, but as a privacy-conscious user I still want to (a) know about it and (b) be able to control/disable it.
madeofpalk 6y ago
Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!
- BoorishBears 6y ago
  ... what? Yes? That's the definition of a deep link? The way you get notified is you open their app... This is a special case when you don't already have the app installed, but being able to read the clipboard without warning is it's own thing, but this specific deep link use-case is extremely benign...
  - just-ok 6y ago
    Ideally, we’d be able to differentiate between local parsing (which I’d deem acceptable) and a remote request, but that quickly enters a gray area. How long after parsing do we validate a request? Is it even viable for a compiler to track the status of a property beyond assignment? And for how long? etc.

trangon 6y ago

How, exactly, are they abusing it? Are you suggesting that they send the contents of the clipboard back to their servers? Do you have any proof that they are using the clipboard for nefarious purposes? It’s disappointing to see the lack of skepticism applied on a site like Hacker News.

pedrovhb 6y ago
What's a legitimate, non-nefarious reason for an app to do that?
- mrtksn 6y ago
  Session restoration after install. Explained here: https://news.ycombinator.com/item?id=23635223 https://news.ycombinator.com/item?id=23635223
- shalmanese 6y ago
  The maker of the Apollo Reddit app chimed in on the reddit thread that his app would check to see if a reddit URL was in the clipboard and offer to take you to that page. Chrome uses it so the URL appears when you select the address bar.
  - lostmsu 6y ago
    Sounds like Chrome doesn't do it in background.
- filleduchaos 6y ago
  The contents of your clipboard _can_ be directly related to the functionality of an app. For example, a link saving app like Pocket might check if your clipboard currently contains a URL when you open it. That allows the app turn a slightly tedious operation (tap/hold input field to bring up context menu, tap paste, tap button to save) into a single tap ("save copied URL?"). Whether or not the convenience is worth it might be debatable, but I fail to see how one would call that nefarious.

madeofpalk 6y ago

In that Reddit thread the author of a Reddit app mentions that they look at the clipboard to see if you have a Reddit link, and offer to open that page in the app (as iOS offers no better way). On Twitter I saw a. Doing app mention they trigger the notification on every key press because they have custom ‘paste’ button that only shows when you have something copied.

robinson7d 6y ago
Sounds like that’s the Apollo app. It’s a pretty nice feature but I find it only seems to work for me when I open the app, so I have to force close it. There’s probably a button for it somewhere, but having one on the home page (or similar) seems like it would be equally good or better UX while also getting the users consent to read their clipboard (since they’re clicking the button). Really nice app in general though.
blisseyGo 6y ago
Yep, for Apollo app, it makes sense why he does it. But for other apps like TikTok, it makes no sense. I wonder if the app also sends the clipboard data after that. Someone should look into network requests being made.
- LordDragonfang 6y ago
  TikTok also has web URLs that they could open in the app, as do many other apps.
  - JimDabell 6y ago
    That’s a different situation though. iOS supports universal links, so a website and iOS application can indicate that when you open a link to the website but have the application installed, the application opens and takes you to the content. This is what TikTok can use to open links to TikTok in the application. But this isn’t a general purpose website => app association. Only the website owner can allow an application to do this. You wouldn’t want, say, Google to set up their application to open DuckDuckGo URLs, for instance. So when it comes to third-party Reddit clients, they can’t automatically open reddit.com URLs because they don’t own reddit.com. The clipboard trick is a workaround for that.

BiteCode_dev 6y ago

"Companies just cannot be trusted with x" has been repeated and repeated for the last decades. I think the conclusion is "Companies just cannot be trusted". At all. With anything. We should assume guilty unless proven overthise for companies. They should go out of their way to show us their good will.

pwdisswordfish2 6y ago

"It seems like a ton of apps are abusing this feature:" Honest question: Why do we need this feature? As a user, I am happy to sacrafice whatever benefit it provides -- to end users -- to stop the abuse. Obviously the feature provides benefits to app developer personal data collectors. OK by me to remove feature.

Cthulhu_ 6y ago
I've never seen a "I will paste your clipboard for you" feature be used in any app, ever.
- eknkc 6y ago
  I like parcel tracking apps detecting a tracking number in clipboard
  - fsflover 6y ago
    Is it also fine that tracking apps read all your passwords in the clipboard?
    - simonklitj 6y ago
      Agreed that this downside is not worth the convenience. But, I think iOS 14 provides a great solution to this problem; you can pattern match against the contents of the clipboard without reading the contents. Then you can always read it if it matches.
- dmit 6y ago
  A dictionary app I use looks at the clipboard when opened and automatically displays a translation iff 1) the copied text is new compared to the previous time the app was used; and 2) the text is in the source language. It's a pretty neat use of the feature, although I'd still gladly let go of it if it means that the other 20 apps I regularly use don't get to rummage through my clipboard for no good reason.
- 6y ago

deleted 6y ago

[deleted]

nuker 6y ago

> It seems like a ton of apps are abusing this feature Can they, if Background Refresh is off for the app? I allow it only for Apple apps.

scarlac 6y ago
Generally, no. But there are ways for an app to stay active in the background. Some are grounds for App Store suspension. Music playing apps may stay somewhat active in the background. However, I don't know if the clipboard API will still work when an app is in the background.

wrkronmiller 6y ago

Why were this apps approved by the app store?

alpb 6y ago

I have a feeling like many of the apps are reading the clipboard on the launch because they probably act on copied text (e.g. if it's a link or a number, they can use that to show a suggested user action). Obviously I might be wrong, but we live in times where many applications are reverse engineered and their traffic is MITM'ed all the time. I'm not sure if anyone’s sending those clipboard contents outside the device. That would be a problem.