Ryan Jones
7 HN mentions · mentioned in 3 months, 2020
0:36 · 183K views · Jun 23, 2020
A one-minute demonstration of iOS 14's new paste notification, which revealed popular apps silently reading the clipboard each time they were opened. It credits the mysk research write-up.
HN cites it as evidence that many mainstream apps, not just TikTok, were snooping on clipboard contents.
7 comments from Hacker News
Great to see another layer of transparency in ios14. Bit I wonder why everyone talking about one specific app? I see a huge bias towards TikTok in headlines "iOS 14 caught TikTok and other apps spying on the clipboard" [0] "iOS 14 beta shows apps like TikTok still spy on your iPhone" [1] There a bunch of apps like VICE, Google News, WSJ that has been caught doing exactly the same. [2] I may find the explanation why TikTok did that. In China WeChat blocks direct links to their competitors. So apps like Taobao or Douyin have to find a workaround for deeplinks. When you want to share the video from Douyin with a friend in WeChat, Douyin generates the following message. 在东京刚毕业入职三个月的职场小白 搬家找房 坚持更新#日本vlog #东京 [LINK] 复制此链接，打开【抖音短视频】，直接观看视频！ In WeChat the link is not clickbale. To see the content user has to copy full text and go to the Douyin. The app will read the clipboard and perform the transition to the video. On the link below you can find the video - explanation [3] Probably they had re-use some code in TikTok. Definitely they need to be more accurate towards data safety but I don't think they really made a pipeline for spying using clipboard. There is a lot of buzz around TikTok these days, but I want to get an answer from other apps as well. [0] [LINK] [1] [LINK] [2] this video [3] [LINK]
>It seems like a ton of apps are abusing this feature: this video Okay, this could be simply a dynamic link library checking for a deep link in the clipboard. Why do this? To preserve the state after install. Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen. The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session. Of course, with iOS 14 the best practice would be to do this only once after the install.
It was "caught" because that's the only one the consent manufacturers reported on. this video Most of the apps in your home screen did it when the beta came out from NYTimes to Google News to Chrome to AccuWeather etc. TikTok shows a pop-up preview of the TikTok link you have in your clipboard when you open TikTok. It might be that, it might be more. But it's certainly not more special than other apps.
It seems like a ton of apps are abusing this feature: this video I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: [LINK] )
> Already forced the family to uninstall it and its gone forever. Honestly you’d be better off educating them and telling them it’s a good idea than forcing them to jettison an app they probably love. Tons of apps do this (as discovered in iOS 14) and I highly suggest not doing a crusade against one when a lot more do it. See: this video