13 votes

LinkedIn iOS app is copying the contents of the clipboard on every keystroke

2 comments

  1. [2]
    Deimos
    Link
    The concerns about apps accessing the clipboard constantly seem pretty overblown to me. A few developers have talked about it, explaining that it was one of the only ways to implement certain...

    The concerns about apps accessing the clipboard constantly seem pretty overblown to me. A few developers have talked about it, explaining that it was one of the only ways to implement certain features before. For example, here's the explanation from the developer of the iOS Reddit app "Apollo":

    Hey! I make Apollo for Reddit and a few people asked me about this and if Apollo does anything with the clipboard so I wanted to answer.

    Since iOS doesn't have a mechanism to open URLs in a specific third party app Apollo has a feature where if you open the app with a Reddit URL on your clipboard it'll offer to open that URL in Apollo, I think I copied this from Instapaper awhile ago.

    This does cause a potentially creepy looking notification with Apollo sometimes, but just wanted to explain why/what it's doing. It's literally just like "Hey iOS, is there a URL on the clipboard? Oh there is, is it a Reddit one? Okay cool let me ask them if they want to open it." Obviously at no point does anything else happen like it leaving the device or anything. It'll show this banner even if there's not a Reddit URL because it needs to check the URL to see if it's a Reddit URL in the first place. Schrodinger's Reddit URL.

    But the clipboard API (prior to iOS 14) was very open, as someone else said, what if medical records were on your clipboard as text? Well in Apollo's case, that doesn't qualify it as a URL, so it wouldn't even "look". (And even for URLs, it doesn't store a list of them even on the device, it just opens it if you ask to, and then saves the most recent URL so it won't keep repeatedly prompting you if you say no.)

    But that doesn't mean other apps couldn't be! They could be doing some Creepy Shitâ„¢ so I think this API change is good. It means I'll have to be more clear with Apollo doing this, and I've already had a few Apple engineers reach out with ways, but I think it's a very good change for user security.

    EDIT: Hell, here's the (pretty simple) code directly from Apollo if anyone's curious: https://gist.github.com/christianselig/f1f9187d8ad6d3e9bc3328dfb0bc6f71

    I don't think there's much to be concerned about overall unless there's some proof of it actually doing something scary with the clipboard contents. For example, if someone examined the LinkedIn app's network traffic and confirmed that it was sending the clipboard contents somewhere, that would obviously be a problem. But it looking at the clipboard repeatedly doesn't really mean much beyond that the app has a feature that can use clipboard contents for something, and it wants to know if the feature should be triggered.

    11 votes
    1. Silbern
      Link Parent
      Love the transparency from the Apollo dev, it's great to see programmers that are willing to explain how or why their programs work the way they do. All too often we treat our craft as a black art...

      Love the transparency from the Apollo dev, it's great to see programmers that are willing to explain how or why their programs work the way they do. All too often we treat our craft as a black art that ordinary people aren't meant to understand the slightest bit of...

      5 votes