Hacker News Reader

Comment by joshuat | Hacker News Reader

This also happened on iOS when they began to prompt users before apps could access the clipboard. I built an app that would handle the inbound redirect automatically if you had a relevant URL in your clipboard - did this for years with many users happy with the feature.

Then it started prompting users before allowing them to paste, and then the claims of privacy violations began to come in.

If instead I were able to specify what was happening in the prompt rather than iOS giving users an ambiguous statement, or even provide a detection pattern, it wouldn't have been nearly as bad.

I feel like this really harms security and privacy awareness by flooding the field with unimportant prompts/warnings to the degree that a real issue is similarly ignored because it is assumed to just be noise.

View on HN

> If instead I were able to specify what was happening in the prompt rather than iOS giving users an ambiguous statement

No. They’re correct, there.

The app developer should not get to provide the message text for a prompt like that.

A secondary note somewhere in less than ten words, maybe, where it explicitly warns that the statement may be false.

> The app developer should not get to provide the message text for a prompt like that.

In App Store apps, where these messages get human review, it could more safely be allowed.

If they allow apps to provide that message from code, that is very hard to test for, even for Apple.

Shady developers would try very hard to get past such checks, for example by changing that message based on the date, IP address range, nearby WiFi networks, receipt of a payload, etc.

They could introduce an optional string-valued entitlement and check its text. That would be a lot easier but still require them to translate messages.

For the iOS permissions I know of (Camera, etc), the message comes from the Info.Plist in the .app bundle, not from code.

App Store reviews are no longer human, they’re LLM

Then why do they still take so long?

LLM should still be able to catch a misleading permission message though.

BlackBerry supported incredibly fine grained permissions way back in the day, and even that wasn't sophisticated enough to support OP's use case.

I don't really even care what OP's good intentions are, because the minute the app is sold, those good intentions are out the window. I use very few apps because I assume they are always going to potentially be adversarial to my interests.

The system warning is correct and should not be subject to the developer promising free candy to gullible users.

Exactly

I had an iOS game I purchased, that, after about 24 hours of use, presented popups that you couldn't dismiss, without opening Safari to the developer's site, and it sent something there. The only way to avoid that, was to force-quit the app. It also likely directly sent stuff to the mothership.

I suspect that was to get around reviewers, and it seems to have worked.

I reported and nuked the app. I have no idea if Apple ever did anything about it.

The baddies are pretty clever.

I think the visibility of these dialogs serves as a warning to the user--but they should do a better job directing the user's attention to where the threat is. If the user is getting annoyed at all these pop-ups, he should direct this annoyance at the developer who is (in all likelihood) asking for access to more of the user's computer than he needs.

The fact that there are so many popups should mean apps are reaching for access to your system way beyond what they should be. It shouldn't mean Apple needs to get rid of the pop-ups.

Regardless, apple should definitely not send popups unless an app is being engaged with.

I get the pop-up semi-frequently from Chrome. I don't think complaining to Google has ever helped with anything; but then it's not like complaining to Apple has a better track record.

Yes, I don't know why the OS isn't tracking the pop-up by bundle id or anything. It's not like I changed my mind the last dozen times…

I love the clipboard warning.

before that, facebook was stealing everything on your clipboard and send back to their server.

This dialog is what it take to stop them.

and it have the pattern detect you asked.

This is a problem with the permission to grant being too coarse. Your app needs blanket access to the clipboard contents. Things would be nicer when it only needs access to relevant URLs in the clipboard.

But that would require the OS to know what a relevant URL is, so the permission must be scoped to a prefix, or maybe a regex(1) to be applied when the clipboard contains text content.

(1) restricted to "proper" regular expressions that don't have the security issues of Perl-style REs.

Chrome extensions do the same thing, but worse (the warnings make it sound like the creator of the extension is going to see every page you visit, when really it's code that runs in the browser; it doesn't take html or any other data anywhere)

But it could… it’s arbitrary code execution and should be scary.

as a user with an itchy delete app finger, this is exactly why i like apple.

Counterpoint: do not read my clipboard without any action on my side, dude!

Reply on news.ycombinator.com