iOS14 Catches Apps Spying on Your Clipboard
Ryan JonesCited 7× on HN, 2020–2020
demo · general · 2020–2020 on HN
A one-minute demonstration of iOS 14's new paste notification, which revealed popular apps silently reading the clipboard each time they were opened. It credits the mysk research write-up.
HN cites it as evidence that many mainstream apps, not just TikTok, were snooping on clipboard contents.
Up next
10 mo on HNDefcon 18 Changing threats to privacy Moxie Marlinspike Part
killab66661
6 HN recommender · 2012–2019
9 mo on HNThis Video Is Sponsored By ███ VPN
Tom Scott
9 HN recommender · 2019–2026
9 mo on HNAmerica Keeps Rejecting an ID Card It Already Has
CGP Grey
14 HN recommender · 2017–2024
7 mo on HNFrank Abagnale | Catch Me If You Can | Talks at Google
Talks at Google
8 HN recommender · 2018–2023
8 mo on HN#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd
Hack In The Box Security Conference
9 HN recommender · 2013–2024
6 mo on HNCybersecurity as Realpolitik by Dan Geer presented at Black Hat USA 2014
Black Hat
1 HN recommend · 2014–2023
6 mo on HN28c3: The coming war on general computation
28c3
6 HN recommender · 2011–2026
6 mo on HNDEF CON 22 - Zoz - Don't Fuck It Up!
DEFCONConference
3 HN recommender · 2016–2021
6 mo on HNData Brokers: Last Week Tonight with John Oliver (HBO)
LastWeekTonight
5 HN recommender · 2022–2024
6 mo on HNCivil War General-Purpose Computing | Cory Doctorow | Talks at Google
Talks at Google
4 HN recommender · 2012–2026
6 mo on HNWe're building a dystopia just to make people click on ads | Zeynep Tufekci
TED
6 HN recommender · 2017–2026
6 mo on HNDEF CON 23 - Chris Rock - I Will Kill You
DEFCONConference
7 HN recommender · 2016–2025
7 comments from Hacker News
It was "caught" because that's the only one the consent manufacturers reported on. ▶ this video Most of the apps in your home screen did it when the beta came out from NYTimes to Google News to Chrome to AccuWeather etc. TikTok shows a pop-up preview of the TikTok link you have in your clipboard when you open TikTok. It might be that, it might be more. But it's certainly not more special than other apps.
When I saw this video of a lot more apps doing it, I did wonder if it actually might be a commonly used third-party library causing this. It's certainly possible. ▶ this video
▶ this video Here's a rundown of just general apps that would be on everyone's home screens doing the same thing.
It seems like a ton of apps are abusing this feature: ▶ this video I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy. (sourced from reddit: link )
>It seems like a ton of apps are abusing this feature: ▶ this video Okay, this could be simply a dynamic link library checking for a deep link in the clipboard. Why do this? To preserve the state after install. Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen. The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session. Of course, with iOS 14 the best practice would be to do this only once after the install.
> Already forced the family to uninstall it and its gone forever. Honestly you’d be better off educating them and telling them it’s a good idea than forcing them to jettison an app they probably love. Tons of apps do this (as discovered in iOS 14) and I highly suggest not doing a crusade against one when a lot more do it. See: ▶ this video
Great to see another layer of transparency in ios14. Bit I wonder why everyone talking about one specific app? I see a huge bias towards TikTok in headlines "iOS 14 caught TikTok and other apps spying on the clipboard" [0] "iOS 14 beta shows apps like TikTok still spy on your iPhone" [1] There a bunch of apps like VICE, Google News, WSJ that has been caught doing exactly the same. [2] I may find the explanation why TikTok did that. In China WeChat blocks direct links to their competitors. So apps like Taobao or Douyin have to find a workaround for deeplinks. When you want to share the video from Douyin with a friend in WeChat, Douyin generates the following message. 在东京刚毕业入职三个月的职场小白 搬家找房 坚持更新#日本vlog #东京 link 复制此链接,打开【抖音短视频】,直接观看视频! In WeChat the link is not clickbale. To see the content user has to copy full text and go to the Douyin. The app will read the clipboard and perform the transition to the video. On the link below you can find the video - explanation [3] Probably they had re-use some code in TikTok. Definitely they need to be more accurate towards data safety but I don't think they really made a pipeline for spying using clipboard. There is a lot of buzz around TikTok these days, but I want to get an answer from other apps as well. [0] link [1] link [2] ▶ this video [3] link