LinkedIn blames bug for clipboard snooping discovered by iOS 14

AppleInsiderAppleInsider
Posted:
in General Discussion edited July 2020
LinkedIn claims that clipboard snooping behavior, recently revealed in the firm's iOS app by a new iOS 14 data privacy feature, is caused by a software bug.

Credit: LinkedIn
Credit: LinkedIn


On Thursday, a portfolio portal developer testing Apple's iOS 14 beta release discovered that the LinkedIn app was copying the contents of their clipboard after every keystroke. When ZDNet reached out to LinkedIn, the company said the issue was tied to a bug in its software.

A day later, LinkedIn product engineering head Erran Berger added more detail about the issue on Twitter, writing that the company had traced the bug to a "code path that only does an equality check clipboard contents and the currently typed content in a text box."

"We don't store or transmit the clipboard contents," Berger wrote, adding that a fix for the issue is on the way.

With iOS 14, Apple will introduce a simple mechanism that notifies users when an app reads contents from their system clipboard. The feature was introduced at WWDC just three months after a pair of developers revealed that the practice was rampant among popular apps.

The LinkedIn controversy comes a week after TikTok, one of the most popular apps in the world, said it would stop snooping on user clipboards after iOS 14 revealed that it was doing just that. TikTok said that the snooping was an anti-spam measure.

Although the iOS 14 feature is raising awareness of clipboard snooping, many apps still carry on with the practice. On Sunday, 54 out of 56 top apps that were found to read the contents of a user's clipboard were still snooping.
«1

Comments

  • Reply 1 of 27
    dewmedewme Posts: 5,362member
    Geez, even a 4 yr old caught with his hand in the cookie jar could come up with a more plausible excuse.  At least they didn't try to blame it on the dog, as in the dog who coded that part of the code was distracted by a squirrel and accidentally implemented the clipboard listener function when his tail hit the keyboard. 

    Woof.
    chasmviclauyycMisterKitmuthuk_vanalingamwilliamlondonGabyspock1234razorpitwatto_cobra
  • Reply 2 of 27
    chasmchasm Posts: 3,296member
    Blatant lying like that (clipboard reading does not happen as a result of a bug) greatly diminishes both my trust and my usage of LinkedIn.
    blurpbleepbloopMisterKitmagman1979muthuk_vanalingamwilliamlondonspock1234watto_cobra
  • Reply 3 of 27
    bonobobbonobob Posts: 382member
    It's a bug, like bugging a phone line, or a conference room.  In other words, this bug is a feature!
    muthuk_vanalingamivanhdewmespock1234watto_cobra
  • Reply 4 of 27
    eriamjheriamjh Posts: 1,642member
    Liar, liar, pants on fire.  
    magman1979muthuk_vanalingammwhiteivanhspock1234watto_cobra
  • Reply 5 of 27
    agilealtitudeagilealtitude Posts: 165member
    I dare to guess what kind of keylogging and clipboard snooping Windows has going on...


    magman1979muthuk_vanalingamwilliamlondonrazorpitwatto_cobra
  • Reply 6 of 27
    viclauyycviclauyyc Posts: 849member
    When no one catch you, it is a feature. 
    When people find out, it is a bug.  
    magman1979fred1mwhiteemoellerivanhspock1234razorpit
  • Reply 7 of 27
    BeatsBeats Posts: 3,073member
    chasm said:
    Blatant lying like that (clipboard reading does not happen as a result of a bug) greatly diminishes both my trust and my usage of LinkedIn.

    Owned by Microsoft.
    magman1979rotateleftbytewilliamlondonGabyspock1234razorpitwatto_cobra
  • Reply 8 of 27
    commentzillacommentzilla Posts: 725member
    Apple needs to change how apps access the clipboard. Leaving it to developers is ridiculous as they can not be trusted. The clipboard should be sandboxed by the system so that apps each have their own clipboard if something is copied and other apps only gain access to that clip if I paste into it.
    edited July 2020 muthuk_vanalingamwilliamlondonlarryjwspock1234razorpitasdasdwatto_cobra
  • Reply 9 of 27
    fred1fred1 Posts: 1,112member
    This is one more feature of iOS 14 that is really great (along with all the others.). I can’t wait for the release. 
    williamlondonlarryjwwatto_cobra
  • Reply 10 of 27
    seanismorrisseanismorris Posts: 1,624member
    Apple dropped the ball.  Apps should never have been allowed to access the clipboard without the users permission.

    Apple then made excuses as it being ‘intended behavior’.  

    That said, Apps frequently do things they’re not supposed to like collect location data, or send information unencrypted.

    I install as few apps as possible and use websites instead.  Location services are disabled unless needed for a trusted app (banking).

    Every App in this list is permanently banned.  I don’t care if it’s 50 years from now, they will NEVER be installed on one of my devices.  

    There are no accidents only business models.  They will violate users privacy again.  Guaranteed!  I’ve stopped counting how many times Facebook had an oops.  Their ban extends to their website...
    larryjwspock1234razorpit
  • Reply 11 of 27
    eriamjheriamjh Posts: 1,642member
    I wonder if Apple will now check for clipboard snooping at app approval?
    watto_cobra
  • Reply 12 of 27
    hmlongcohmlongco Posts: 537member
    Might in fact be a bug. LinkedIn on iOS is a "hybrid" app meaning most of the app is in fact not native code. It might have been grabbing the clipboard data on every event just to enable/disable features. The real question is whether or not any of that data is making its way back to the servers....
    Rayz2016MplsPwatto_cobra
  • Reply 13 of 27
    emoelleremoeller Posts: 574member
    Earlier this year I splurged and purchased Little Snitch - a small app that tracks/traces all traffic activity.   I was shocked at how many (thousands) trackers are installed and used on my computers.   Fortunately one can turn them off and on within Little Snitch, but it can be tricky because some of them are required for apps to run and/or update.  

    It even shows a map where the information is being sent - shocking number of data sent internationally.

    I used to store private information in Contacts, only to find out that none of that is private.  And now of course anything cut and pasted is apparently open to all.    

    I applaud Apple for their privacy efforts, but worried that we are all way behind on this issue.
    dewmespock1234watto_cobra
  • Reply 14 of 27
    larryjwlarryjw Posts: 1,031member
    commentzilla said:
    Apple needs to change how apps access the clipboard. Leaving it to developers is ridiculous as they can not be trusted. The clipboard should be sandboxed by the system so that apps each have their own clipboard if something is copied and other apps only gain access to that clip if I paste into it.
    I like your idea. And, of course, only access to the clipboard if the app is directed to copy into it. But, if there an app has their own clipboard how will a receiving app know which clip to read?

    btw, apple’s messages app has a problem with the clipboard on the Mac. When I open messages, it fills my message line with some words from either the clipboard or some other source, before I have a chance to enter my message. Disconcerting. 
    watto_cobra
  • Reply 15 of 27
    looplessloopless Posts: 329member
    Ascribing some sinister intent is paranoid. Some programmer probably thought it was a good idea to enable some capability. And the clipboard API is public allowed since forever on iOS. As long as the data is simply being checked, then its sort of  absurd  to assume that LinkedIn are somehow 'stealing' clipboard content for nefarious purposes. There are so many better ways to get data than some random clipboard text.  No one ever thinks about this on the desktop like MacOS and Windows. Applications are always checking the clipboard for pasteable content.
    netroxMplsPanonconformist
  • Reply 16 of 27
    sflocalsflocal Posts: 6,093member
    Calm down people... 

    it’s very possible the classes many of the developers used included code that did this process without them knowing, and is only now being discovered with iOS14.

    i suspect the majority of the apps did nothing with it.  The ones to worry about are those nefarious developers that discovered it, said nothing, and did something with the copied clipboard.

    This is good actually.  Means code will be that much more tightened. 
    razorpitMplsP
  • Reply 17 of 27
    ivanhivanh Posts: 597member
    It’s an Xcode feature. If it’s not, the source code can’t build an app with it.
  • Reply 18 of 27
    mattinozmattinoz Posts: 2,316member
    Similar to LinkedIn and every security issue to date..
  • Reply 19 of 27
    Rayz2016Rayz2016 Posts: 6,957member
    larryjw said:
    commentzilla said:
    Apple needs to change how apps access the clipboard. Leaving it to developers is ridiculous as they can not be trusted. The clipboard should be sandboxed by the system so that apps each have their own clipboard if something is copied and other apps only gain access to that clip if I paste into it.
    I like your idea. And, of course, only access to the clipboard if the app is directed to copy into it. But, if there an app has their own clipboard how will a receiving app know which clip to read?

    iOS would need to maintain a record of the last clipboard copied/cut to, and then paste from that one. The other problem is that maintaining a separate clipboard for every running application would exhaust the phone's memory in about a day.

  • Reply 20 of 27
    Rayz2016Rayz2016 Posts: 6,957member

    sflocal said:
    Calm down people... 

    it’s very possible the classes many of the developers used included code that did this process without them knowing, and is only now being discovered with iOS14.

    i suspect the majority of the apps did nothing with it.  The ones to worry about are those nefarious developers that discovered it, said nothing, and did something with the copied clipboard.

    This is good actually.  Means code will be that much more tightened. 

    Ascribing some sinister intent is paranoid. Some programmer probably thought it was a good idea to enable some capability. And the clipboard API is public allowed since forever on iOS. As long as the data is simply being checked, then its sort of  absurd  to assume that LinkedIn are somehow 'stealing' clipboard content for nefarious purposes. There are so many better ways to get data than some random clipboard text.  No one ever thinks about this on the desktop like MacOS and Windows. Applications are always checking the clipboard for pasteable content.

    These.

    In most cases, we're just looking at bad programming, though it's good that it's being highlighted.

    edited July 2020 razorpitMplsPbeowulfschmidtwatto_cobra
Sign In or Register to comment.