5 ms·

An explanation from LinkedIn: https://twitter.com/eberger45/status/1278843576638570496 https://twitter.com/eberger45/status/1278843576638570496 ------ Hi @Do

An explanation from LinkedIn: https://twitter.com/eberger45/status/1278843576638570496 https://twitter.com/eberger45/status/1278843576638570496 ------ Hi @DonCubed . Appreciate you raising this. We've traced this to a code path that only does an equality check between the clipboard contents and the currently typed content in a text box. We don't store or transmit the clipboard contents. ---------- An example of this is in a library we have open sourced, and you can find the fix here [https://github.com/linkedin/Hakawai/ https://github.com/linkedin/Hakawai/ (https://github.com/linkedin/Hakawai/pull/161/files/3881de3686e03920e367a508b21664d4a2985e94#diff-8dd7fa9c03c488418eef19eaa4489405 https://github.com/linkedin/Hakawai/pull/161/files/3881de368...). We will follow up once the fix is live in our app. -----------

fingerlocks 6y ago
This should be higher, above all of the mobs teething for vengeance. It’s an innocuous comparison of text input to the pasteboard to prevent unwanted autocorrect insertions.[0] Probably the same code used by TikTok too. the code and and comments are here: [0] https://github.com/linkedin/Hakawai/pull/162/commits/c3f89585c097863c2017beb2a1774df21ad42da4#diff-8dd7fa9c03c488418eef19eaa4489405L369 https://github.com/linkedin/Hakawai/pull/162/commits/c3f8958...
- erikrothoff 6y ago
  Seeing the mob mentality surrounding this is honestly scary. All the top voted comments have pretty much decided that this is used for nefarious purposes, with absolutely zero evidence. Same goes for TikTok and the DDG favicon saga from yesterday. Whatever happened to Occam’s (edit: Meant Hanlon's) razor?
  - unionpivo 6y ago
    > Whatever happened to Occam’s razor? The reaction from people in this thread is the result of occam's razor. If site is caught doing shady things repeatedly over the years and then another shady thing is revealed. Most likely/simple explanation is that they are doing jet another shady thing. Same goes for TikTok and Zoom for me. Not sure what DDG saga you mean, i must have missed that.
    - McDev 6y ago
      https://news.ycombinator.com/item?id=23708166 https://news.ycombinator.com/item?id=23708166
      - Lio 6y ago
        LinkedIn's business model is base around surveillance. DDG's is specifically based around providing services without surveillance. So if DDG make a mistake I give them the benefit of the doubt because I can see it's in the their interests to fix that. If LinkedIn make a mistake, based on previous behaviour, I assume that the mistake was getting caught and that another mistake will be announced any time now. I don't use LinkedIn for this reason.
  - leokennis 6y ago
    Eh. It’s like I already punched you in the face 9 times. The 10th time I’m making a punching motion, you’re probably going to duck away. Even if I wasn’t going to punch you, but instead giving you an ice cream. If you’re a shitty company (TikTok, LinkedIn) people are going to assume you’re acting shitty when it looks like you’re acting shitty.
    - GordonS 6y ago
      Yeah, it's like The Boy that Cried Wolf - sure, people shouldn't jump to conclusions, but if we're shown something enough times it's easy to become conditioned to a particular expectation.
  - gpvos 6y ago
    Linkedin has been doing lots of bad things before, like asking for users' email passwords. Occam's razor applies, and it's to Linkedin's disadvantage. By the way, maybe you mean Hanlon's razor (never attribute to malice that which is adequately explained by stupidity).
  - deleted 6y ago
    [deleted]
  - nottorp 6y ago
    I uninstalled the Linkedin app like 30 minutes after first trying it a couple years ago because it was bombarding me with useless notifications. Then on the Microsoft purchase they redid their site in some crap javascript framework that keeps reloading elements and is 3x as slow as the previous version of the site. I didn't even assume malice when i read the article title, i assumed incompetence.
- Lio 6y ago
  LinkedIn (Microsoft) is a company that previously used man-in-the-middle techniques to move people's private emails to its servers.[1] People no longer give them the benefit of that doubt because of the reputational damage these previous violations have caused. They should stop making "innocent" mistakes with other people's privacy and deal with this more professionally at the highest levels. If they don't people will continue to jump to the conclusion that this sort of activity resembles criminal behaviour. [1] http://www.pcwelt.de/news/LinkedIn_liest_Ihre_E-Mails_mit-Intro-8281685.html http://www.pcwelt.de/news/LinkedIn_liest_Ihre_E-Mails_mit-In...
  - fingerlocks 6y ago
    Sure, I get it. LinkedIn's email plugin thing was a security nightmare. But in this case, the code is right there! Take a step back and look at the entire forest: The outrage is over an app accessing data specifically designed to be shared across applications. That's what Copy fundamentally means- make this thing globally available to all my programs. You can poll pbpaste/xsel in your terminal and generate a log of the clipboard buffer without any privileges. Does this mean an untrustworthy app could, in theory, snoop your plaintext password copied from a password manager? Sure, but that's a separate discussion. Ask yourself, does it make sense to implement clipboard snooping in a way that polls the pasteboard on every keystroke while an input form remains in focus? No, that's weird, there's obvious bug stench. LinkedIn may be nefarious, but defaulting to instant outrage and lack of critical thinking is the real concern here.
    - pacoverdi 6y ago
      > That's what Copy fundamentally means- make this thing globally available to all my programs Wouldn't that be: Copy means- "make this thing go into MY clipboard". Paste means- "make my clipboard available to THIS application".
      - efreak 6y ago
        Copy and paste are application-level interfaces; the operating system holds the data, but has always given it up on demand. I've actually seen some applications that use the clipboard as an IPC mechanism (most recently, a Python application, I don't recall what for, was wiping URLs from my clipboard to see if it was already running)
- fit2rule 6y ago
  Just, no. There is NO possible excuse for accessing my private clipboard buffer without my involvement - as a result of a direct action I have overtly initiated.
  - tqi 6y ago
    If there is no legitimate reason for it to happen, should this be prevented at the OS level?
    - tornato7 6y ago
      Yes. People copy passwords, SSNs, crypto wallet secrets, and more in a clipboard that pretty much any app or website or system service can see without permission. I'm surprised we haven't seen more attacks on it, honestly. I have long wanted to build a secure multi-clipboard, one where you can copy with Ctrl+shift+1, ctrl+shift+2 etc and paste with Ctrl+1 and Ctrl+2 It would keep those hidden from any app until explicitly pasted. I was thinking you could co-opt the system keyboard to get the same functionality, but it clears the system clipboard instantly after any copy/paste.
      - nix23 6y ago
        Hmm good idea, maybe you can integrate that into Klipper: https://userbase.kde.org/Klipper https://userbase.kde.org/Klipper
Grustaf 6y ago
Why would they do this check all the time, rather than just at the moment the text box contents changes?
- genoapol 6y ago
  New fingerprinting technique or clipboard data used to expand a user's shadow profile?
yread 6y ago
So we should turn our pitchforks on Apple who designed textbox component that needs hacks for autocomplete AND not tested updates with apps to notice this spammy useless notification.
stunt 6y ago
Many other apps are doing this as well. At this point, I think anyone that uses this technique should be very transparent about this and explain it to users or just remove this feature. Otherwise, it's too late when a tweetstorm is out.
NumberCruncher 6y ago
> An example of this is in a library we have open sourced, and you can find the fix here This reads for me like: As an example of this I go to the shooting range every Friday, just for fun, as you can see it on this picture I published on FB, that's why I didn't shoot my neighbour. He may be right, but that's not an evidence. And we are talking about a company acting like a con man since ages.
- stunt 6y ago
  > He may be right, but that's not an evidence. And we are talking about a company acting like a con man since ages. I don't have any reason to not believe their explanation. And I don't think my clipboard is useful to them for anything else. Many other apps are doing it as well and a few of them gave the same explanation. But, that doesn't mean that copying clipboard is a good idea. I don't like any app to copy my clipboard. I also don't like it that apps/companies don't respect any boundaries unless it's forced/blocked by the OS. They just try too hard to reach where they don't need to reach. If there wasn't enough restriction from the OS, surely someone has already came up with a "creative" idea to detect spammers using front camera or reading device storage and a lot of apps were using it. I don't like it that companies aren't sensitive about user rights and what users feel about what they are doing.
  - luckylion 6y ago
    > I don't have any reason to not believe their explanation. Why not? They've been engaging in very, very dark gray area things before. > And I don't think my clipboard is useful to them for anything else. Don't you ever copy paste anything mildly interesting, like email-addresses, phone numbers to add to your address book, form contents before submitting a form in case the site is terrible and resets the form on error etc? I'm sure they'd love to get their hand on that information, as it'll allow for data mining to better "understand you".
bobthechef 6y ago
Such explanations are not reassuring. The problem for me isn't whether LinkedIn is actually using the clipboard, it's the very fact that they have access to it and can do that in principle. Why do apps even have unrestricted access to the clipboard? Do we give apps unrestricted access to cookies? No.
- scarface74 6y ago
  Actually we do. Any app that uses the in process embedded web view on iOS has access to anything that you enter on the website including passwords and they have access to cookies. You might expect that from Chrome but what about your RSS news reader? My preferred news reader Feedly uses the out of process embedded WebView so its a moot point.

fingerlocks 6y ago

This should be higher, above all of the mobs teething for vengeance. It’s an innocuous comparison of text input to the pasteboard to prevent unwanted autocorrect insertions.[0] Probably the same code used by TikTok too. the code and and comments are here: [0] https://github.com/linkedin/Hakawai/pull/162/commits/c3f89585c097863c2017beb2a1774df21ad42da4#diff-8dd7fa9c03c488418eef19eaa4489405L369 https://github.com/linkedin/Hakawai/pull/162/commits/c3f8958...

erikrothoff 6y ago
Seeing the mob mentality surrounding this is honestly scary. All the top voted comments have pretty much decided that this is used for nefarious purposes, with absolutely zero evidence. Same goes for TikTok and the DDG favicon saga from yesterday. Whatever happened to Occam’s (edit: Meant Hanlon's) razor?
- unionpivo 6y ago
  > Whatever happened to Occam’s razor? The reaction from people in this thread is the result of occam's razor. If site is caught doing shady things repeatedly over the years and then another shady thing is revealed. Most likely/simple explanation is that they are doing jet another shady thing. Same goes for TikTok and Zoom for me. Not sure what DDG saga you mean, i must have missed that.
  - McDev 6y ago
    https://news.ycombinator.com/item?id=23708166 https://news.ycombinator.com/item?id=23708166
    - Lio 6y ago
      LinkedIn's business model is base around surveillance. DDG's is specifically based around providing services without surveillance. So if DDG make a mistake I give them the benefit of the doubt because I can see it's in the their interests to fix that. If LinkedIn make a mistake, based on previous behaviour, I assume that the mistake was getting caught and that another mistake will be announced any time now. I don't use LinkedIn for this reason.
- leokennis 6y ago
  Eh. It’s like I already punched you in the face 9 times. The 10th time I’m making a punching motion, you’re probably going to duck away. Even if I wasn’t going to punch you, but instead giving you an ice cream. If you’re a shitty company (TikTok, LinkedIn) people are going to assume you’re acting shitty when it looks like you’re acting shitty.
  - GordonS 6y ago
    Yeah, it's like The Boy that Cried Wolf - sure, people shouldn't jump to conclusions, but if we're shown something enough times it's easy to become conditioned to a particular expectation.
- gpvos 6y ago
  Linkedin has been doing lots of bad things before, like asking for users' email passwords. Occam's razor applies, and it's to Linkedin's disadvantage. By the way, maybe you mean Hanlon's razor (never attribute to malice that which is adequately explained by stupidity).
- deleted 6y ago
  [deleted]
- nottorp 6y ago
  I uninstalled the Linkedin app like 30 minutes after first trying it a couple years ago because it was bombarding me with useless notifications. Then on the Microsoft purchase they redid their site in some crap javascript framework that keeps reloading elements and is 3x as slow as the previous version of the site. I didn't even assume malice when i read the article title, i assumed incompetence.
Lio 6y ago
LinkedIn (Microsoft) is a company that previously used man-in-the-middle techniques to move people's private emails to its servers.[1] People no longer give them the benefit of that doubt because of the reputational damage these previous violations have caused. They should stop making "innocent" mistakes with other people's privacy and deal with this more professionally at the highest levels. If they don't people will continue to jump to the conclusion that this sort of activity resembles criminal behaviour. [1] http://www.pcwelt.de/news/LinkedIn_liest_Ihre_E-Mails_mit-Intro-8281685.html http://www.pcwelt.de/news/LinkedIn_liest_Ihre_E-Mails_mit-In...
- fingerlocks 6y ago
  Sure, I get it. LinkedIn's email plugin thing was a security nightmare. But in this case, the code is right there! Take a step back and look at the entire forest: The outrage is over an app accessing data specifically designed to be shared across applications. That's what Copy fundamentally means- make this thing globally available to all my programs. You can poll pbpaste/xsel in your terminal and generate a log of the clipboard buffer without any privileges. Does this mean an untrustworthy app could, in theory, snoop your plaintext password copied from a password manager? Sure, but that's a separate discussion. Ask yourself, does it make sense to implement clipboard snooping in a way that polls the pasteboard on every keystroke while an input form remains in focus? No, that's weird, there's obvious bug stench. LinkedIn may be nefarious, but defaulting to instant outrage and lack of critical thinking is the real concern here.
  - pacoverdi 6y ago
    > That's what Copy fundamentally means- make this thing globally available to all my programs Wouldn't that be: Copy means- "make this thing go into MY clipboard". Paste means- "make my clipboard available to THIS application".
    - efreak 6y ago
      Copy and paste are application-level interfaces; the operating system holds the data, but has always given it up on demand. I've actually seen some applications that use the clipboard as an IPC mechanism (most recently, a Python application, I don't recall what for, was wiping URLs from my clipboard to see if it was already running)
fit2rule 6y ago
Just, no. There is NO possible excuse for accessing my private clipboard buffer without my involvement - as a result of a direct action I have overtly initiated.
- tqi 6y ago
  If there is no legitimate reason for it to happen, should this be prevented at the OS level?
  - tornato7 6y ago
    Yes. People copy passwords, SSNs, crypto wallet secrets, and more in a clipboard that pretty much any app or website or system service can see without permission. I'm surprised we haven't seen more attacks on it, honestly. I have long wanted to build a secure multi-clipboard, one where you can copy with Ctrl+shift+1, ctrl+shift+2 etc and paste with Ctrl+1 and Ctrl+2 It would keep those hidden from any app until explicitly pasted. I was thinking you could co-opt the system keyboard to get the same functionality, but it clears the system clipboard instantly after any copy/paste.
    - nix23 6y ago
      Hmm good idea, maybe you can integrate that into Klipper: https://userbase.kde.org/Klipper https://userbase.kde.org/Klipper

Grustaf 6y ago

Why would they do this check all the time, rather than just at the moment the text box contents changes?

genoapol 6y ago
New fingerprinting technique or clipboard data used to expand a user's shadow profile?

yread 6y ago

So we should turn our pitchforks on Apple who designed textbox component that needs hacks for autocomplete AND not tested updates with apps to notice this spammy useless notification.

stunt 6y ago

Many other apps are doing this as well. At this point, I think anyone that uses this technique should be very transparent about this and explain it to users or just remove this feature. Otherwise, it's too late when a tweetstorm is out.

NumberCruncher 6y ago

> An example of this is in a library we have open sourced, and you can find the fix here This reads for me like: As an example of this I go to the shooting range every Friday, just for fun, as you can see it on this picture I published on FB, that's why I didn't shoot my neighbour. He may be right, but that's not an evidence. And we are talking about a company acting like a con man since ages.

stunt 6y ago
> He may be right, but that's not an evidence. And we are talking about a company acting like a con man since ages. I don't have any reason to not believe their explanation. And I don't think my clipboard is useful to them for anything else. Many other apps are doing it as well and a few of them gave the same explanation. But, that doesn't mean that copying clipboard is a good idea. I don't like any app to copy my clipboard. I also don't like it that apps/companies don't respect any boundaries unless it's forced/blocked by the OS. They just try too hard to reach where they don't need to reach. If there wasn't enough restriction from the OS, surely someone has already came up with a "creative" idea to detect spammers using front camera or reading device storage and a lot of apps were using it. I don't like it that companies aren't sensitive about user rights and what users feel about what they are doing.
- luckylion 6y ago
  > I don't have any reason to not believe their explanation. Why not? They've been engaging in very, very dark gray area things before. > And I don't think my clipboard is useful to them for anything else. Don't you ever copy paste anything mildly interesting, like email-addresses, phone numbers to add to your address book, form contents before submitting a form in case the site is terrible and resets the form on error etc? I'm sure they'd love to get their hand on that information, as it'll allow for data mining to better "understand you".

bobthechef 6y ago

Such explanations are not reassuring. The problem for me isn't whether LinkedIn is actually using the clipboard, it's the very fact that they have access to it and can do that in principle. Why do apps even have unrestricted access to the clipboard? Do we give apps unrestricted access to cookies? No.

scarface74 6y ago
Actually we do. Any app that uses the in process embedded web view on iOS has access to anything that you enter on the website including passwords and they have access to cookies. You might expect that from Chrome but what about your RSS news reader? My preferred news reader Feedly uses the out of process embedded WebView so its a moot point.