Hacker News Reader

Comment by xvector | Hacker News Reader

It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem.

I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance.

I wish they just cut the bullshit and fixed these holes though, they've been around for years. It's really depressing to see Apple's fantastic security work in other parts of the stack be completely and utterly compromised by OS design decisions like this.

View on HN

Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

This is true for nearly all apps, but it is important to consider special cases. I use a keyboard app (SwiftKey) that shows contents of clipboard, if recently added, as a shortcut button. It's pretty nice. I can probably turn it off but I don't intend to.

Accessibility apps likely have a lot of examples like this too

Also, Apollo for Reddit prompts to open a link if you have a reddit link on your clipboard.

ParcelTrack tells me if there is a tracking number in my clipboard and begins the process of adding a new shipment to track.

Funny enough, Safari just opened up clipboard access via the async clipboard API: https://webkit.org/blog/10855/async-clipboard-api/

It does require a user initiated event to work, but then you can access the user's clipboard with:

`await navigator.clipboard.read();`

There are some additional restrictions though (you can read them in the first link) which it might make sense for iOS as a whole to adopt.

JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo.

It used to be true but all that was fixed like 10 years ago.

I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?

Reading from the clipboard is allowed on a user-triggered event.

It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event.

Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

> user-triggered event

“Click Reject All Cookies to exercise your GDPR rights!”

This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.

> Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

Somehow I didn't even realize that's how they were getting around it! I just thought, "Dang, I thought I turned that crap off." Good callout.

The first time you did this your browser asked for a permission via browser's native permission modal

In Safari you get a browser-provided popup menu that just has "Paste" in it when you click on the Google Docs Paste button, it doesn't paste directly

In Firefox it doesn't. When you click, a modal panel appears reminding you of the shortcuts.

Sadly, user interaction does not have to be something done by the user with intent. As another comment below mentions, the code to manipulate the clipboard can be hidden yet still kicked off by the user interacting normally with the website.

Don't know about a repo, but https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A...

How is manipulating clipboard not a problem? What if something replaces your fingerprint or bitcoin address?

An app being able to declare some operations to perform on the clipboard (overwrite, append, etc) that don't return any information about the contents are not a problem from a privacy or security perspective. At most they can be annoying.

If your clipboard contents were overwritten with an arbitrary wallet address immediately before you paste into an exchange's "Send BTC to..." field, that would be a pretty big problem.

I wouldn't expect that most people would double-check to make sure a series of gibberish characters matches what they expect, especially if they don't have any reason to suspect that paste wouldn't output exactly what they copied a moment ago.

Untrue, you can copy sure, but you cannot paste.

If you're using JS to read the clipboard, you don't need to paste. Assume that the purpose of reading the clipboard is not for a useful thing for the user but a nefarious use for the app/site maintainer. The would just send the read data back to their server without the user knowing.

There are cases where it's fine to access the clipboard without me pasting. My reddit app for example auto-detects reddit-links on my clipboard and asks if I want to open the link in the app if it finds one

>I wonder if Apple is playing 4D chess here though

Ockham's razor says that they just don't care enough about this.

wonder if Apple is playing 4D chess here though

Why 4D? Isn't chess just a 2D game with wormholes?

Are you suggesting the movement of knights (and possibly kings and rooks) can be explained by wormholes?

Well, anything that requires jumping (knights) must require at least a third dimension. Now, 3D chess I’ve never learned, but how do pieces move there?

Reply on news.ycombinator.com