PSA: All Apps Can Read Your iPhone and Android Clipboard

A TikTok logo on a phone with a figure using a laptop in the background.
DANIEL CONSTANTE / Shutterstock.com

Have you seen the news from TikTok? A new privacy feature in iOS 14 revealed that Chinese social media app constantly read iPhone clipboards. But this is nothing new. All apps can read your smartphone clipboard whenever they want.

We just learned what apps are already doing

What TikTok was doing was nothing new. The only new thing is that Apple’s iOS 14 update now notifies you when an app captures (pasta) content from your clipboard.

Of course, after people noticed and the company started getting bad press, TikTok claimed it did not store the data and deployed an update to stop reading. But like Engadget points out that many other applications do the same thing: read data from your clipboard all the time.

Why do smartphones allow apps to read the clipboard?

When you copy something to your clipboard, applications can read the contents of your clipboard without you manually selecting “Paste.” It is by design.

For example, when you copy a tracking number to your clipboard on an iPhone or iPad and open a package tracking application, it may recognize that you have a tracking number and offer to automatically add it. When you copy a web address (URL) to your clipboard and open a browser, it may prompt you to automatically access that address.

It’s just more convenient than forcing you to press a “Paste” button every time you want to move something to another application.

This applies to the Apple iPhone and iPad as well as Android. Whichever smartphone operating system you use, apps can read your clipboard.

Chrome for iPhone automatically reads the clipboard.

Your copied text could be sent to a remote server

But, as TikTok has demonstrated, apps can also just capture content from your clipboard in the background and do whatever they want with it. They can send the contents of your clipboard to a remote server.

We don’t accuse any app of doing it – we’re just saying it’s technically possible and nothing stops it in iOS or Android. Applications don’t need to ask authorization before reading your clipboard as before reading your contacts, photos and location.

Copying private things is risky

Let’s say you use a password manager and you need to copy an online banking password or credit card number to paste it into another application. If you leave this private information on your clipboard, other applications you use, such as TikTok, can read your clipboard and see this data.

The same goes for other types of sensitive data, such as names and addresses or even private photos. The apps you open can see what’s on your clipboard.

The only way to really protect yourself after copying the data is to clear your clipboard by copying other data. For example, you can highlight any word on any web page or in any application and select “Copy.”

Apple IOS and iPadOS, as well as Android, don’t remember the history of items you copied to your clipboard like Windows 10 can. Applications can just see the current item on your clipboard, which is the last thing you copied.

This is why many password management applications have an option to automatically erase the clipboard after a certain time. For example, 1Password for iPhone has an “Erase clipboard” option under Settings> Security which will automatically erase things you copy after 90 seconds. Passwords and other private data don’t hide on your clipboard for hours. However, any application you use within the first 90 seconds can still read to your clipboard.

1Password's option to erase the clipboard from the iPhone.

On a desktop or laptop computer, it’s different –

Technically, on a Windows PC or Mac, any application you use can also read your clipboard at any time.

However, on a traditional desktop system, you probably access many services through your web browser. Web applications cannot automatically read your clipboard without your permission. You must manually paste to the website to deliver the contents of your clipboard to the website.

On an iPhone, iPad, or Android device, you use many applications that would otherwise be websites. Facebook website can’t monitor your clipboard, but the Facebook application on your phone can certainly.

Your clipboard is not as private as you think

Apple’s new copy and paste notifications in iOS 14 are a reminder of the actual access to apps on our phones. You won’t see the same stories on Android anytime soon, but it’s only because Android doesn’t have a notification that tells you when apps read from your clipboard in the background.

Ultimately, it’s a good reminder that you need to be careful when copying and pasting private information, as well as when installing and choosing to trust apps.

There is no way to install an app for iPhone, iPad or Android without also giving it permission to read from your clipboard.

RELATED: What’s new in iOS 14 (and iPadOS 14, watchOS 7, AirPods, more)

https://platform.twitter.com/widgets.js

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.