Hacker News Reader

Comment by Ultramanoid | Hacker News Reader

This is throwing the baby with the bathtub, completely ridiculous.

They could remove internet permission from all applications except Google's own Chrome, with that reasoning.

Instead of removing clipboard permissions from all applications, make it a clear option so that the user can give it when needed or only to a specific application, for instance the essential clipboard manager -- that Android incomprehensibly doesn't have and never has, as part of its core. So far only third-party applications have provided this needed feature.

Bundling clipboard with Google's keyboard ( or others like Swiftkey ) that come loaded with unnecessary permissions ( like internet -- I personally never use a keyboard with that permission ! ) and analytics packages is certainly not improving privacy at all.

View on HN

I'd bet that less than 0.1% of users use a custom clipboard. Android's primary focus should be to make the OS secure for the nontechnical majority. These are people who don't understand permissions, and will click on app installer popups. IMHO this is a welcome move.

An alternative would have been to deny all network access to clipboard apps - thereby ensuring that they are not able to steal any data.

According to numbers of downloads of clipboard managers, it's probably much higher than that. But the reasoning doesn't stand. Like I said, they could remove all phony Chrome clones with massive analytics and calls home, of which there are dozens, with read and write storage permissions, internet permission, etc, the list goes on and on. And say only Chrome is allowed, or vetted browsers from known vendors, like Mozilla or Microsoft, they certainly should, but they don't do it.

Yet they pick on an essential feature for anyone using copy and paste hundreds of times a day.

There is much more danger in rogue browsers, by far, than in a clipboard manager.

The solution is absolutely obvious. It isn't what they decided. It is just the first beta, but we'll see.

It'd be ridiculous to need to have a text file always open in another application with constantly used bits of text, code, or info, and switch back and forth as needed multiplying a simple workflow by who knows how much in operations and time.

I'm sorry, but I think even saying 0.1% of users use a clipboard manager is way overestimating it.

The top clipboard manager apps have like 500k installs. Android had 2.7 billion users in 2017. If we assume that the Android install base hasn't grown and that the total base of clipboard managers is 10x larger, we still only get to 0.18% of users...

Clipper [1] alone has over a million installations. Others as you say have 500k, it all amounts to millions of users of clipboard managers specifically labelled as such. Add other applications which couldn't work without a clipboard monitoring feature ( KDE Connect has been mentioned already, translation applications, text and code editors, the list goes on... ) and you jump to tens of millions if not hundreds of millions.

[1] https://play.google.com/store/apps/details?id=org.rojekti.cl...

I've no idea how many people use them, but I do and it's easy to get used to.

What I use is an app called KDE Connect, which provides a shared clipboard with my desktop computer if the phone is on the same WLAN. It's neat. Really neat. And of course it needs network access.

How many actual people (as in persons) are those 0.1% when it comes to Android? People here always operate with percentages like they're worth anything as absolute numbers.

In which Android version Internet needs permission? Mine (7.1.1) does not have such a setting.

Applications require permissions to run.

Many require internet permission although it makes no sense. For instance all Google keyboards have internet permission. And most others. That something that can record and transmit every single thing one types has that permission, to me, seems insane and I certainly will use only keyboards that do not have such asinine requirement.

Edit : https://fixitalready.eff.org/android/#/

Looked up, thanks. Seems you can't grant or revoke that permission. I don't understand why having it at all if you cannot change it.

I use my own system, based on LineageOS [1], which comes with settings to block internet permission on any application. It's one of LineageOS' features. ( On top of that I root my devices and use AFWall+ [2] which also creates a configurable firewall with iptables. )

[1] https://lineageos.org/

[2] https://f-droid.org/en/packages/dev.ukanth.ufirewall/

Well, one use it has is to know when to stay away from something that requires it despite not needing it. Do not install such application.

Even without Internet permission there are easy ways to exfiltrate critical data.

For example, the app could just open the browser set to http://myapp.com/?secretdata=Ultramanoids_password

How are you going to stop that? Have the browser stop and ask before loading the web page?

Wouldn't that be visible?

Yes, but by then your data is already exfiltrated.

There are also a bunch of ways of doing it in non-visible ways by using API's of other apps

Amy keyboards you could recommend? Ideally available on f-droid.

I need Japanese and Chinese, also handwritten for kanji, and the only one that combines both without analytics or internet permission currently is Multiling O [1] but I am hoping for an alternative, because it is only distributed through the Play Store, and I do not use Google services.

Otherwise, open source and on F-Droid there's AnySoftKeyboard [2] and even a build of Mozc [3], this last one unfortunately with internet permission.

[1] https://play.google.com/store/apps/details?id=kl.ime.oh

[2] https://f-droid.org/en/packages/com.menny.android.anysoftkey...

[3] https://f-droid.org/en/packages/org.mozc.android.inputmethod...

"Hacker's Keyboard" on f-droid had a long and venerable history.

Reply on news.ycombinator.com