LinkedIn blames bug for clipboard snooping discovered by iOS 14

Jump to First Reply
AppleInsiderAppleInsider
Posted:
in General Discussion edited July 2020
LinkedIn claims that clipboard snooping behavior, recently revealed in the firm's iOS app by a new iOS 14 data privacy feature, is caused by a software bug.

Credit: LinkedIn
Credit: LinkedIn


On Thursday, a portfolio portal developer testing Apple's iOS 14 beta release discovered that the LinkedIn app was copying the contents of their clipboard after every keystroke. When ZDNet reached out to LinkedIn, the company said the issue was tied to a bug in its software.

A day later, LinkedIn product engineering head Erran Berger added more detail about the issue on Twitter, writing that the company had traced the bug to a "code path that only does an equality check clipboard contents and the currently typed content in a text box."

"We don't store or transmit the clipboard contents," Berger wrote, adding that a fix for the issue is on the way.

With iOS 14, Apple will introduce a simple mechanism that notifies users when an app reads contents from their system clipboard. The feature was introduced at WWDC just three months after a pair of developers revealed that the practice was rampant among popular apps.

The LinkedIn controversy comes a week after TikTok, one of the most popular apps in the world, said it would stop snooping on user clipboards after iOS 14 revealed that it was doing just that. TikTok said that the snooping was an anti-spam measure.

Although the iOS 14 feature is raising awareness of clipboard snooping, many apps still carry on with the practice. On Sunday, 54 out of 56 top apps that were found to read the contents of a user's clipboard were still snooping.
«1

Comments

  • Reply 1 of 27
    dewmedewme Posts: 6,040member
    Geez, even a 4 yr old caught with his hand in the cookie jar could come up with a more plausible excuse.  At least they didn't try to blame it on the dog, as in the dog who coded that part of the code was distracted by a squirrel and accidentally implemented the clipboard listener function when his tail hit the keyboard. 

    Woof.
    chasmviclauyycMisterKitmuthuk_vanalingamwilliamlondonGabyspock1234razorpitwatto_cobra
     8Likes 0Dislikes 1Informative
  • Reply 2 of 27
    chasmchasm Posts: 3,746member
    Blatant lying like that (clipboard reading does not happen as a result of a bug) greatly diminishes both my trust and my usage of LinkedIn.
    blurpbleepbloopMisterKitmagman1979muthuk_vanalingamwilliamlondonspock1234watto_cobra
     7Likes 0Dislikes 0Informatives
  • Reply 3 of 27
    bonobobbonobob Posts: 405member
    It's a bug, like bugging a phone line, or a conference room.  In other words, this bug is a feature!
    muthuk_vanalingamivanhdewmespock1234watto_cobra
     5Likes 0Dislikes 0Informatives
  • Reply 4 of 27
    eriamjheriamjh Posts: 1,838member
    Liar, liar, pants on fire.  
    magman1979muthuk_vanalingammwhiteivanhspock1234watto_cobra
     6Likes 0Dislikes 0Informatives
  • Reply 5 of 27
    agilealtitudeagilealtitude Posts: 165member
    I dare to guess what kind of keylogging and clipboard snooping Windows has going on...


    magman1979muthuk_vanalingamwilliamlondonrazorpitwatto_cobra
     5Likes 0Dislikes 0Informatives
  • Reply 6 of 27
    viclauyycviclauyyc Posts: 849member
    When no one catch you, it is a feature. 
    When people find out, it is a bug.  
    magman1979fred1mwhiteemoellerivanhspock1234razorpit
     7Likes 0Dislikes 0Informatives
  • Reply 7 of 27
    Beatsbeats Posts: 3,073member
    chasm said:
    Blatant lying like that (clipboard reading does not happen as a result of a bug) greatly diminishes both my trust and my usage of LinkedIn.

    Owned by Microsoft.
    magman1979rotateleftbytewilliamlondonGabyspock1234razorpitwatto_cobra
     6Likes 0Dislikes 1Informative
  • Reply 8 of 27
    commentzillacommentzilla Posts: 793member
    Apple needs to change how apps access the clipboard. Leaving it to developers is ridiculous as they can not be trusted. The clipboard should be sandboxed by the system so that apps each have their own clipboard if something is copied and other apps only gain access to that clip if I paste into it.
    edited July 2020
    muthuk_vanalingamwilliamlondonlarryjwspock1234razorpitasdasdwatto_cobra
     6Likes 0Dislikes 1Informative
  • Reply 9 of 27
    fred1fred1 Posts: 1,161member
    This is one more feature of iOS 14 that is really great (along with all the others.). I can’t wait for the release. 
    williamlondonlarryjwwatto_cobra
     3Likes 0Dislikes 0Informatives
  • Reply 10 of 27
    seanismorrisseanismorris Posts: 1,624member
    Apple dropped the ball.  Apps should never have been allowed to access the clipboard without the users permission.

    Apple then made excuses as it being ‘intended behavior’.  

    That said, Apps frequently do things they’re not supposed to like collect location data, or send information unencrypted.

    I install as few apps as possible and use websites instead.  Location services are disabled unless needed for a trusted app (banking).

    Every App in this list is permanently banned.  I don’t care if it’s 50 years from now, they will NEVER be installed on one of my devices.  

    There are no accidents only business models.  They will violate users privacy again.  Guaranteed!  I’ve stopped counting how many times Facebook had an oops.  Their ban extends to their website...
    larryjwspock1234razorpit
     3Likes 0Dislikes 0Informatives
  • Reply 11 of 27
    eriamjheriamjh Posts: 1,838member
    I wonder if Apple will now check for clipboard snooping at app approval?
    watto_cobra
     1Like 0Dislikes 0Informatives
  • Reply 12 of 27
    hmlongcohmlongco Posts: 637member
    Might in fact be a bug. LinkedIn on iOS is a "hybrid" app meaning most of the app is in fact not native code. It might have been grabbing the clipboard data on every event just to enable/disable features. The real question is whether or not any of that data is making its way back to the servers....
    Rayz2016MplsPwatto_cobra
     3Likes 0Dislikes 0Informatives
  • Reply 13 of 27
    emoelleremoeller Posts: 600member
    Earlier this year I splurged and purchased Little Snitch - a small app that tracks/traces all traffic activity.   I was shocked at how many (thousands) trackers are installed and used on my computers.   Fortunately one can turn them off and on within Little Snitch, but it can be tricky because some of them are required for apps to run and/or update.  

    It even shows a map where the information is being sent - shocking number of data sent internationally.

    I used to store private information in Contacts, only to find out that none of that is private.  And now of course anything cut and pasted is apparently open to all.    

    I applaud Apple for their privacy efforts, but worried that we are all way behind on this issue.
    dewmespock1234watto_cobra
     2Likes 0Dislikes 1Informative
  • Reply 14 of 27
    larryjwlarryjw Posts: 1,038member
    commentzilla said:
    Apple needs to change how apps access the clipboard. Leaving it to developers is ridiculous as they can not be trusted. The clipboard should be sandboxed by the system so that apps each have their own clipboard if something is copied and other apps only gain access to that clip if I paste into it.
    I like your idea. And, of course, only access to the clipboard if the app is directed to copy into it. But, if there an app has their own clipboard how will a receiving app know which clip to read?

    btw, apple’s messages app has a problem with the clipboard on the Mac. When I open messages, it fills my message line with some words from either the clipboard or some other source, before I have a chance to enter my message. Disconcerting. 
    watto_cobra
     1Like 0Dislikes 0Informatives
  • Reply 15 of 27
    looplessloopless Posts: 362member
    Ascribing some sinister intent is paranoid. Some programmer probably thought it was a good idea to enable some capability. And the clipboard API is public allowed since forever on iOS. As long as the data is simply being checked, then its sort of  absurd  to assume that LinkedIn are somehow 'stealing' clipboard content for nefarious purposes. There are so many better ways to get data than some random clipboard text.  No one ever thinks about this on the desktop like MacOS and Windows. Applications are always checking the clipboard for pasteable content.
    netroxMplsPanonconformist
     3Likes 0Dislikes 0Informatives
  • Reply 16 of 27
    sflocalsflocal Posts: 6,165member
    Calm down people... 

    it’s very possible the classes many of the developers used included code that did this process without them knowing, and is only now being discovered with iOS14.

    i suspect the majority of the apps did nothing with it.  The ones to worry about are those nefarious developers that discovered it, said nothing, and did something with the copied clipboard.

    This is good actually.  Means code will be that much more tightened. 
    razorpitMplsP
     2Likes 0Dislikes 0Informatives
  • Reply 17 of 27
    ivanhivanh Posts: 597member
    It’s an Xcode feature. If it’s not, the source code can’t build an app with it.
     0Likes 0Dislikes 0Informatives
  • Reply 18 of 27
    mattinozmattinoz Posts: 2,644member
    Similar to LinkedIn and every security issue to date..
     0Likes 0Dislikes 0Informatives
  • Reply 19 of 27
    Rayz2016rayz2016 Posts: 6,957member
    larryjw said:
    commentzilla said:
    Apple needs to change how apps access the clipboard. Leaving it to developers is ridiculous as they can not be trusted. The clipboard should be sandboxed by the system so that apps each have their own clipboard if something is copied and other apps only gain access to that clip if I paste into it.
    I like your idea. And, of course, only access to the clipboard if the app is directed to copy into it. But, if there an app has their own clipboard how will a receiving app know which clip to read?

    iOS would need to maintain a record of the last clipboard copied/cut to, and then paste from that one. The other problem is that maintaining a separate clipboard for every running application would exhaust the phone's memory in about a day.

     0Likes 0Dislikes 0Informatives
  • Reply 20 of 27
    Rayz2016rayz2016 Posts: 6,957member

    sflocal said:
    Calm down people... 

    it’s very possible the classes many of the developers used included code that did this process without them knowing, and is only now being discovered with iOS14.

    i suspect the majority of the apps did nothing with it.  The ones to worry about are those nefarious developers that discovered it, said nothing, and did something with the copied clipboard.

    This is good actually.  Means code will be that much more tightened. 

    Ascribing some sinister intent is paranoid. Some programmer probably thought it was a good idea to enable some capability. And the clipboard API is public allowed since forever on iOS. As long as the data is simply being checked, then its sort of  absurd  to assume that LinkedIn are somehow 'stealing' clipboard content for nefarious purposes. There are so many better ways to get data than some random clipboard text.  No one ever thinks about this on the desktop like MacOS and Windows. Applications are always checking the clipboard for pasteable content.

    These.

    In most cases, we're just looking at bad programming, though it's good that it's being highlighted.

    edited July 2020
    razorpitMplsPbeowulfschmidtwatto_cobra
     4Likes 0Dislikes 0Informatives
Sign In or Register to comment.