Re:iOS14 reveals that TikTok may snoop clipboard contents ev...
by just-ok on Wednesday June 24, 2020 @10:16PM
(#23636187)
That's all well and good, but as a privacy-conscious user I still want to (a) know about it and (b) be able to control/disable it.
Re:iOS14 reveals that TikTok may snoop clipboard contents ev...
by madeofpalk on Wednesday June 24, 2020 @10:30PM
(#23636283)
Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!
Re:iOS14 reveals that TikTok may snoop clipboard contents ev...
by BoorishBears on Wednesday June 24, 2020 @11:58PM
(#23636770)
... what?
Yes? That's the definition of a deep link? The way you get notified is you open their app...
This is a special case when you don't already have the app installed, but being able to read the clipboard without warning is it's own thing, but this specific deep link use-case is extremely benign...
Re:iOS14 reveals that TikTok may snoop clipboard contents ev...
by just-ok on Thursday June 25, 2020 @01:47AM
(#23637294)
Ideally, we’d be able to differentiate between local parsing (which I’d deem acceptable) and a remote request, but that quickly enters a gray area. How long after parsing do we validate a request? Is it even viable for a compiler to track the status of a property beyond assignment? And for how long? etc.
Okay, this could be simply a dynamic link library checking for a deep link in the clipboard.
Why do this? To preserve the state after install.
Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen.
The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session.
Of course, with iOS 14 the best practice would be to do this only once after the install.