4 ms·

Every day I read about another outrage being committed by another garbage app that I do not have and would never install on my phone. Why do people need a Linke

Every day I read about another outrage being committed by another garbage app that I do not have and would never install on my phone. Why do people need a LinkedIn app? Even if you think that you need LinkedIn, can’t you access your please-spam-me account through your browser? Isn’t it obvious that every closed-source mystery program that you install increases your attack surface? You wouldn't click on an email attachment from a stranger in Russia, so why install an executable from a company that you already know is unethical?

inetknght 6y ago
Think it's just the app? Hope you don't have your clipboard events enabled in your browser Edit for those interested: tl;dr: "asynchronous clipboard API" [0] Overtly, it's used by shit news sites like WSJ, nytimes, and bloomberg to inject their shit into your clipboard when you copy-paste. A common thing I've noticed is selecting text, copying the text, and then pasting somewhere and seeing a link to the original article instead. I'm not sure if they're still doing it; there has been several people complaining about this over time [1] [2] [3] [4] [5] [6]. I found this awesome article on the Security StackExchange from 2013 [8]. Also it's not just javascript. You might be forgiven to think that using a command-line interface would spare you. Unfortunately you'd be wrong; mosh, tmux, vi, emacs all support your terminal emulator's clipboard events. [7] [8] [0]: https://www.w3.org/TR/clipboard-apis/ https://www.w3.org/TR/clipboard-apis/ [1]: 4 months ago: https://news.ycombinator.com/item?id=22352674 https://news.ycombinator.com/item?id=22352674 [2]: 4 months ago: https://news.ycombinator.com/item?id=22446940 https://news.ycombinator.com/item?id=22446940 [3]: 8 months ago: https://news.ycombinator.com/item?id=21377598 https://news.ycombinator.com/item?id=21377598 [4]: March 2019: https://news.ycombinator.com/item?id=19384895 https://news.ycombinator.com/item?id=19384895 [5]: December 2017: https://news.ycombinator.com/item?id=16034854 https://news.ycombinator.com/item?id=16034854 [6]: September 2015: https://news.ycombinator.com/item?id=10301881 https://news.ycombinator.com/item?id=10301881 [7]: Three months ago: https://news.ycombinator.com/item?id=22815757 https://news.ycombinator.com/item?id=22815757 [8]: https://security.stackexchange.com/q/39118/47800 https://security.stackexchange.com/q/39118/47800
- leephillips 6y ago
  Can you explain this a bit for me here?
  - deleted 6y ago
    [deleted]
- methyl 6y ago
  To read the clipboard, website needs explicit permission to do so, no way to go unnoticed.
  - xvolter 6y ago
    Right. Firefox and Safari (iOS and desktop) haven't implemented the Clipboard.read functionality yet either, only Chrome has and it's only available on use action such as a click or keydown (and not available on touch or scroll events). But they can copy to your clipboard for you, a lot of services use "Click to copy" features. But reading is much harder. iOS before 14.0 appears to have allowed apps to read clipboard contents without making that clear to users. Now that you get a notification whenever an app reads the clipboard, it has become fairly clear a lot of apps are reading clipboards constantly. For what… we all wonder.
- Johnjonjoan 6y ago
  I read something recently that gave the impression browsers didn't allow this and they could only modify the clipboard? I'm not saying this is true, rather asking if I got the wrong impression.
- leephillips 6y ago
  Thanks for the details. I agree that it’s obnoxious for sites to interfere with copy. But they still can’t read from the clipboard, which is the topic here. And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?
  - inetknght 6y ago
avs733 6y ago
Yeah, but companies are more competent than government and that's what matters https://news.ycombinator.com/item?id=23716931 https://news.ycombinator.com/item?id=23716931 right?
dmart 6y ago
Perhaps not relevant to LinkedIn specifically, but in general people install these apps because they eventually get fed up with the purposefully crippled mobile website badgering them about it. Ever tried to use Yelp or Reddit's mobile websites? Impossible.
- D2187645 6y ago
  If only there was a app for always on desktop mode.
  - Macha 6y ago
    You can just turn the toggle on in Firefox on Android and it stays on in that tab until you turn it off (or close the tab)
- tomjakubowski 6y ago
  I'm a little surprised that iOS content blockers haven't seemed to address nagware.
  - Nextgrid 6y ago
    Content blockers aren't allowed to inject arbitrary JS which is often necessary to fix broken websites, unlike uBlock Origin.
- leephillips 6y ago
  Actually, no, I never have. But if I wanted to wallow in these sewers for some reason, and the mobile sites were unusable, I would use my laptop, or just manage to find some way to survive without them. Installing their apps is out of the question.
- thesimon 6y ago
  >Ever tried to use Yelp or Reddit's mobile websites? Impossible The other day I tried to view a subreddit in Safari. It was literally impossible, it was claimed to be only available in the app.
deleted 6y ago
[deleted]
koheripbal 6y ago
What I don't understand is why the browsers and OSs aren't preventing this. This is a massive security hole. An app doesn't need access to the clipboard unless I'm actively pasting to it while it's in focus.

inetknght 6y ago

Think it's just the app? Hope you don't have your clipboard events enabled in your browser Edit for those interested: tl;dr: "asynchronous clipboard API" [0] Overtly, it's used by shit news sites like WSJ, nytimes, and bloomberg to inject their shit into your clipboard when you copy-paste. A common thing I've noticed is selecting text, copying the text, and then pasting somewhere and seeing a link to the original article instead. I'm not sure if they're still doing it; there has been several people complaining about this over time [1] [2] [3] [4] [5] [6]. I found this awesome article on the Security StackExchange from 2013 [8]. Also it's not just javascript. You might be forgiven to think that using a command-line interface would spare you. Unfortunately you'd be wrong; mosh, tmux, vi, emacs all support your terminal emulator's clipboard events. [7] [8] [0]: https://www.w3.org/TR/clipboard-apis/ https://www.w3.org/TR/clipboard-apis/ [1]: 4 months ago: https://news.ycombinator.com/item?id=22352674 https://news.ycombinator.com/item?id=22352674 [2]: 4 months ago: https://news.ycombinator.com/item?id=22446940 https://news.ycombinator.com/item?id=22446940 [3]: 8 months ago: https://news.ycombinator.com/item?id=21377598 https://news.ycombinator.com/item?id=21377598 [4]: March 2019: https://news.ycombinator.com/item?id=19384895 https://news.ycombinator.com/item?id=19384895 [5]: December 2017: https://news.ycombinator.com/item?id=16034854 https://news.ycombinator.com/item?id=16034854 [6]: September 2015: https://news.ycombinator.com/item?id=10301881 https://news.ycombinator.com/item?id=10301881 [7]: Three months ago: https://news.ycombinator.com/item?id=22815757 https://news.ycombinator.com/item?id=22815757 [8]: https://security.stackexchange.com/q/39118/47800 https://security.stackexchange.com/q/39118/47800

leephillips 6y ago
Can you explain this a bit for me here?
- deleted 6y ago
  [deleted]
methyl 6y ago
To read the clipboard, website needs explicit permission to do so, no way to go unnoticed.
- xvolter 6y ago
  Right. Firefox and Safari (iOS and desktop) haven't implemented the Clipboard.read functionality yet either, only Chrome has and it's only available on use action such as a click or keydown (and not available on touch or scroll events). But they can copy to your clipboard for you, a lot of services use "Click to copy" features. But reading is much harder. iOS before 14.0 appears to have allowed apps to read clipboard contents without making that clear to users. Now that you get a notification whenever an app reads the clipboard, it has become fairly clear a lot of apps are reading clipboards constantly. For what… we all wonder.
Johnjonjoan 6y ago
I read something recently that gave the impression browsers didn't allow this and they could only modify the clipboard? I'm not saying this is true, rather asking if I got the wrong impression.
leephillips 6y ago
Thanks for the details. I agree that it’s obnoxious for sites to interfere with copy. But they still can’t read from the clipboard, which is the topic here. And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?
- inetknght 6y ago

avs733 6y ago

Yeah, but companies are more competent than government and that's what matters https://news.ycombinator.com/item?id=23716931 https://news.ycombinator.com/item?id=23716931 right?

dmart 6y ago

Perhaps not relevant to LinkedIn specifically, but in general people install these apps because they eventually get fed up with the purposefully crippled mobile website badgering them about it. Ever tried to use Yelp or Reddit's mobile websites? Impossible.

D2187645 6y ago
If only there was a app for always on desktop mode.
- Macha 6y ago
  You can just turn the toggle on in Firefox on Android and it stays on in that tab until you turn it off (or close the tab)
tomjakubowski 6y ago
I'm a little surprised that iOS content blockers haven't seemed to address nagware.
- Nextgrid 6y ago
  Content blockers aren't allowed to inject arbitrary JS which is often necessary to fix broken websites, unlike uBlock Origin.
leephillips 6y ago
Actually, no, I never have. But if I wanted to wallow in these sewers for some reason, and the mobile sites were unusable, I would use my laptop, or just manage to find some way to survive without them. Installing their apps is out of the question.
thesimon 6y ago
>Ever tried to use Yelp or Reddit's mobile websites? Impossible The other day I tried to view a subreddit in Safari. It was literally impossible, it was claimed to be only available in the app.

deleted 6y ago

[deleted]

koheripbal 6y ago

What I don't understand is why the browsers and OSs aren't preventing this. This is a massive security hole. An app doesn't need access to the clipboard unless I'm actively pasting to it while it's in focus.