7 ms·

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

np_tedious 6y ago
This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too
- Wingy 6y ago
  Also, Apollo for Reddit prompts to open a link if you have a reddit link on your clipboard.
- MadcapJake 6y ago
  ParcelTrack tells me if there is a tracking number in my clipboard and begins the process of adding a new shipment to track.
Me1000 6y ago
Funny enough, Safari just opened up clipboard access via the async clipboard API: https://webkit.org/blog/10855/async-clipboard-api/ https://webkit.org/blog/10855/async-clipboard-api/ It does require a user initiated event to work, but then you can access the user's clipboard with: `await navigator.clipboard.read();` There are some additional restrictions though (you can read them in the first link) which it might make sense for iOS as a whole to adopt.
dylan604 6y ago
JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.
- deleted 6y ago
  [deleted]
- greggman3 6y ago
  Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.
  - spideymans 6y ago
    I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?
    - shakna 6y ago
      Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.
      - gorgoiler 6y ago
        > user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”
        andy_ppp 6y ago
        This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
      - mavsman 6y ago
hutattedonmyarm 6y ago
There are cases where it's fine to access the clipboard without me pasting. My reddit app for example auto-detects reddit-links on my clipboard and asks if I want to open the link in the app if it finds one

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

np_tedious 6y ago

This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to. Accessibility apps likely have a lot of examples like this too

Wingy 6y ago
Also, Apollo for Reddit prompts to open a link if you have a reddit link on your clipboard.
MadcapJake 6y ago
ParcelTrack tells me if there is a tracking number in my clipboard and begins the process of adding a new shipment to track.

Me1000 6y ago

Funny enough, Safari just opened up clipboard access via the async clipboard API: https://webkit.org/blog/10855/async-clipboard-api/ https://webkit.org/blog/10855/async-clipboard-api/ It does require a user initiated event to work, but then you can access the user's clipboard with: `await navigator.clipboard.read();` There are some additional restrictions though (you can read them in the first link) which it might make sense for iOS as a whole to adopt.

dylan604 6y ago

JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

deleted 6y ago
[deleted]
greggman3 6y ago
Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.
- spideymans 6y ago
  I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?
  - shakna 6y ago
    Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.
    - gorgoiler 6y ago
      > user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”
      - andy_ppp 6y ago
        This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
    - mavsman 6y ago

hutattedonmyarm 6y ago

There are cases where it's fine to access the clipboard without me pasting. My reddit app for example auto-detects reddit-links on my clipboard and asks if I want to open the link in the app if it finds one