<story><title>Popular iPhone and iPad Apps Snooping on the Pasteboard</title><url>https://www.mysk.blog/2020/03/10/popular-iphone-and-ipad-apps-snooping-on-the-pasteboard/</url></story><parent_chain></parent_chain><comment><author>kennywinker</author><text>The pasteboard API is essentially the same in iOS as it is in macOS. Which means it&amp;#x27;s an api that was likely designed more than 20 years ago. Because of that, it was not designed for the user-hostile app world we live in, where developers will harness any api that can leak data about the user.&lt;p&gt;A solution to this is to re-design this api so that it allows developers to query for specific matches, but requires user-action to unlock them I.e. I can passively ask &amp;quot;does the clipboard contain a photo?&amp;quot; or &amp;quot;does the clipboard contain a url in the *.facebook.com domain?&amp;quot; but in order to get the contents I have to prompt the user to manually paste. Probably this would require putting these queries in the info plist, so that they can be validated by app review and you don&amp;#x27;t get developers brute-forcing the contents with large numbers of generated queries.&lt;p&gt;This is very similar to how apple solved apps detecting what other apps you have installed using `-[UIApplication canOpenURL:]`. Apple added rate limiting and an info-plist based whitelist, which essentially put a stop to this practice.</text></comment>
<story><title>Popular iPhone and iPad Apps Snooping on the Pasteboard</title><url>https://www.mysk.blog/2020/03/10/popular-iphone-and-ipad-apps-snooping-on-the-pasteboard/</url></story><parent_chain></parent_chain><comment><author>banana_giraffe</author><text>Something that confuses me:&lt;p&gt;Windows app can do this.  Heck, in the case of a Windows app, you need not even poll the clipboard, you can sign up for notifications when it changes.  The API is ancient, well documented, and provides no feedback when it&amp;#x27;s being used.  And some apps indeed use it, one obvious one is remote desktop apps use it to &amp;quot;sniff&amp;quot; what&amp;#x27;s in the clipboard to mirror it along.&lt;p&gt;Is there a reason whatever security trade offs are OK in Windows, but not on a phone?</text></comment>