7 ms·
Here's a test you should run. Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is. Copy
by PatrolX 6y ago
Here's a test you should run.
Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is.
Copy that bitly link to your clipboard and repeat what you're doing in that video.
Monitor the bitly link for clicks.
Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits and keep a record of the IP addresses.
- zerd 6y agoYou can also use something like requestbin/postbin to capture the whole requests and see IPs, headers etc.
- xvector 6y agoIt is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these holes though, they've been around for years. It's really depressing to see Apple's fantastic security work in other parts of the stack be completely and utterly compromised by OS design decisions like this.
- greggman3 6y agoAgreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.
- np_tedious 6y agoThis is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too
- Wingy 6y agoAlso, Apollo for Reddit prompts to open a link if you have a reddit link on your clipboard.
- MadcapJake 6y agoParcelTrack tells me if there is a tracking number in my clipboard and begins the process of adding a new shipment to track.
- Me1000 6y agoFunny enough, Safari just opened up clipboard access via the async clipboard API: https://webkit.org/blog/10855/async-clipboard-api/ https://webkit.org/blog/10855/async-clipboard-api/ It does require a user initiated event to work, but then you can access the user's clipboard with: `await navigator.clipboard.read();` There are some additional restrictions though (you can read them in the first link) which it might make sense for iOS as a whole to adopt.
- dylan604 6y agoJavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.
- deleted 6y ago[deleted]
- greggman3 6y agoManipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.
- spideymans 6y agoI’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?
- shakna 6y agoReading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.
- gorgoiler 6y ago> user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”
- andy_ppp 6y agoThis is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
- hutattedonmyarm 6y agoThere are cases where it's fine to access the clipboard without me pasting. My reddit app for example auto-detects reddit-links on my clipboard and asks if I want to open the link in the app if it finds one
- edoloughlin 6y agowonder if Apple is playing 4D chess here though Why 4D? Isn't chess just a 2D game with wormholes?
- WiseWeasel 6y agoAre you suggesting the movement of knights (and possibly kings and rooks) can be explained by wormholes?
- colejohnson66 6y agoWell, anything that requires jumping (knights) must require at least a third dimension. Now, 3D chess I’ve never learned, but how do pieces move there?
- on_and_off 6y ago>I wonder if Apple is playing 4D chess here though Ockham's razor says that they just don't care enough about this.
- coronadisaster 6y agoI did that many years ago but with email... I sent a secret link from and to a microft email address and it was then accessed by a microsoft bot...
- skim_milk 6y agoOf course, they inspect received/sent email for spam/antivirus purposes
- hunter2_ 6y agoI've had these inspections deplete single-use links such as a Slack magic login link. I actually side with "GET should be idempotent" but it's still annoying.
- leoh 6y agoIt can also be used for safety/security — i.e. I believe GMail proxies remote images through their own servers.
- calvinmorrison 6y agoFastmail as well. It minimizes attack surface on a client. If you send an email to bob@fastmail.com, fastmail's IP is recorded as accessing the image, not Bob's home IP address.
- fouc 6y agoI hope someone does this and reports the results
- Lt_Riza_Hawkeye 6y ago[canarytokens](https://canarytokens.org/generate https://canarytokens.org/generate) are built for this, though I wouldn't use them for anything long-running
- chrsstrm 6y agoIt's even easier than that, just use ngrok. I recorded a demo video of a web interface running locally via ngrok. Left the tunnel up while the video uploaded to YouTube so I could send it privately to a colleague and during processing I started to see requests on my tunnel. YT scraped the URL from the video and was requesting it one char at a time until the entire address was complete. IIRC this was almost two years ago. That was also the day I decided no more visible private links in YT videos.
- samanator 6y agoThat's wild! What do you mean they were requesting it one character at a time? The URL itself? If so,how do you know that? Do you also own urls in that "character space" leading up to your URL?
- kevingadd 6y agoMy guess is that each frame of the video was OCR'd for text, so as the author typed a URL in one character at a time it was producing unique substrings on-screen and the youtube bot dutifully tried to fetch each of those unique substrings
- lgats 6y agoWas it YouTube that was requesting the link (maybe for anti-phishing purposes?) Or Googlebot?
- 6y ago
- aasasd 6y agoWhile you're at it, you can try opening your page in Chrome and watching the log afterwards. Dunno is the ‘feature’ is still there, it was over five years ago.
- INTPenis 6y agoI was in a situation like this once recently. I was trying to send a password pusher link to my brother over Signal. The password pusher was set to expire after 1 day or 1 view. And my brother kept saying the link didn't work. Of course it doesn't work when Signal fetches it before him to make a preview! Had to set it to exactly 2 views and then he could view the password. And iirc the Signal-desktop release for Linux I was using could not disable previews of links. And even if it could, his end might have previewed it.
- lixtra 6y agoThe password should have been shown after a POST request, not to a simple GET request. Put a button “click her to see password, you got one chance” to trigger the POST.