3 ms·

Can someone answer why iOS even allows the ability to read the clipboard buffer in the first place? Just seems like poor privacy and security design.

MuffinFlavored 6y ago
so that if you switch from app A to app B, it can check your clipboard buffer for if you have a URL pasted into it and load that URL in the context of the app example: if you copied twitter://foo/tweet/bar or https://twitter.com/foo/tweet/bar https://twitter.com/foo/tweet/bar, it checks your clipboard and loads that tweet instantly at least that's what i read over on reddit about this on r/apple
- ebg13 6y ago
  Except that letting apps randomly pull from the clipboard, where you might have copied passwords, bank account numbers, or any other sensitive information, is such an obviously unsafe idea that the person who suggested it should have been immediately sent to special privacy consciousness training. For what? To save one "send to app" or "paste"? At least reserve that functionality exclusively for the operating system on the grounds of "TRUST YOU? HAHAHAHAHA".
- beervirus 6y ago
  A super minor convenience feature, and enabling it allows apps to just read from my clipboard at will? The juice ain't worth the squeeze.
ebg13 6y ago
I know, right? It's not super hard to imagine a parallel universe where any software can copy to the clipboard but only the OS, upon user request, can paste back out of it. And yet here we are wallowing in filth. Why, because people have never heard of a callback before? Let the application include a "paste" handler function, and then all clipboard exfiltration must be initiated by the user at the OS UI layer. Simple. Safe.
perfectstorm 6y ago
I copy my password from my password manager and paste it into a different app. I can copy notes from OneNote and paste it into my email and there are many other use cases i can think of. With iOS 14 Apple is letting the user know that some app is accessing your clipboard.
- ebg13 6y ago
  All of your examples are things initiated directly by the user. There's no reason that preserving user-initiated "paste" needs to mean letting an app take what it wants.
  - perfectstorm 6y ago
    it wasn't clear from OP. i suppose having a permission modal like Photos or Contacts will do.

MuffinFlavored 6y ago

so that if you switch from app A to app B, it can check your clipboard buffer for if you have a URL pasted into it and load that URL in the context of the app example: if you copied twitter://foo/tweet/bar or https://twitter.com/foo/tweet/bar https://twitter.com/foo/tweet/bar, it checks your clipboard and loads that tweet instantly at least that's what i read over on reddit about this on r/apple

ebg13 6y ago
Except that letting apps randomly pull from the clipboard, where you might have copied passwords, bank account numbers, or any other sensitive information, is such an obviously unsafe idea that the person who suggested it should have been immediately sent to special privacy consciousness training. For what? To save one "send to app" or "paste"? At least reserve that functionality exclusively for the operating system on the grounds of "TRUST YOU? HAHAHAHAHA".
beervirus 6y ago
A super minor convenience feature, and enabling it allows apps to just read from my clipboard at will? The juice ain't worth the squeeze.

ebg13 6y ago

I know, right? It's not super hard to imagine a parallel universe where any software can copy to the clipboard but only the OS, upon user request, can paste back out of it. And yet here we are wallowing in filth. Why, because people have never heard of a callback before? Let the application include a "paste" handler function, and then all clipboard exfiltration must be initiated by the user at the OS UI layer. Simple. Safe.

perfectstorm 6y ago

I copy my password from my password manager and paste it into a different app. I can copy notes from OneNote and paste it into my email and there are many other use cases i can think of. With iOS 14 Apple is letting the user know that some app is accessing your clipboard.

ebg13 6y ago
All of your examples are things initiated directly by the user. There's no reason that preserving user-initiated "paste" needs to mean letting an app take what it wants.
- perfectstorm 6y ago
  it wasn't clear from OP. i suppose having a permission modal like Photos or Contacts will do.