6 ms·

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem. I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance. I wish they just cut the bullshit and fixed these holes though, they've been around for years. It's really depressing to see Apple's fantastic security work in other parts of the stack be completely and utterly compromised by OS design decisions like this.

greggman3 6y ago
Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.
- np_tedious 6y ago
  This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too
  - Wingy 6y ago
    Also, Apollo for Reddit prompts to open a link if you have a reddit link on your clipboard.
  - MadcapJake 6y ago
    ParcelTrack tells me if there is a tracking number in my clipboard and begins the process of adding a new shipment to track.
- Me1000 6y ago
  Funny enough, Safari just opened up clipboard access via the async clipboard API: https://webkit.org/blog/10855/async-clipboard-api/ https://webkit.org/blog/10855/async-clipboard-api/ It does require a user initiated event to work, but then you can access the user's clipboard with: `await navigator.clipboard.read();` There are some additional restrictions though (you can read them in the first link) which it might make sense for iOS as a whole to adopt.
- dylan604 6y ago
  JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.
  - deleted 6y ago
    [deleted]
  - greggman3 6y ago
    Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.
    - spideymans 6y ago
      I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?
      - shakna 6y ago
        Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.
        gorgoiler 6y ago
        > user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”
        andy_ppp 6y ago
        This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
- hutattedonmyarm 6y ago
  There are cases where it's fine to access the clipboard without me pasting. My reddit app for example auto-detects reddit-links on my clipboard and asks if I want to open the link in the app if it finds one
edoloughlin 6y ago
wonder if Apple is playing 4D chess here though Why 4D? Isn't chess just a 2D game with wormholes?
- WiseWeasel 6y ago
  Are you suggesting the movement of knights (and possibly kings and rooks) can be explained by wormholes?
  - colejohnson66 6y ago
    Well, anything that requires jumping (knights) must require at least a third dimension. Now, 3D chess I’ve never learned, but how do pieces move there?
on_and_off 6y ago
>I wonder if Apple is playing 4D chess here though Ockham's razor says that they just don't care enough about this.

greggman3 6y ago

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

np_tedious 6y ago
This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too
- Wingy 6y ago
  Also, Apollo for Reddit prompts to open a link if you have a reddit link on your clipboard.
- MadcapJake 6y ago
  ParcelTrack tells me if there is a tracking number in my clipboard and begins the process of adding a new shipment to track.
Me1000 6y ago
Funny enough, Safari just opened up clipboard access via the async clipboard API: https://webkit.org/blog/10855/async-clipboard-api/ https://webkit.org/blog/10855/async-clipboard-api/ It does require a user initiated event to work, but then you can access the user's clipboard with: `await navigator.clipboard.read();` There are some additional restrictions though (you can read them in the first link) which it might make sense for iOS as a whole to adopt.
dylan604 6y ago
JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.
- deleted 6y ago
  [deleted]
- greggman3 6y ago
  Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.
  - spideymans 6y ago
    I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?
    - shakna 6y ago
      Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.
      - gorgoiler 6y ago
        > user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”
        andy_ppp 6y ago
        This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
hutattedonmyarm 6y ago
There are cases where it's fine to access the clipboard without me pasting. My reddit app for example auto-detects reddit-links on my clipboard and asks if I want to open the link in the app if it finds one

edoloughlin 6y ago

wonder if Apple is playing 4D chess here though Why 4D? Isn't chess just a 2D game with wormholes?

WiseWeasel 6y ago
Are you suggesting the movement of knights (and possibly kings and rooks) can be explained by wormholes?
- colejohnson66 6y ago
  Well, anything that requires jumping (knights) must require at least a third dimension. Now, 3D chess I’ve never learned, but how do pieces move there?

on_and_off 6y ago

>I wonder if Apple is playing 4D chess here though Ockham's razor says that they just don't care enough about this.