Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Cellphones Communications Handhelds Portables (Apple) Hardware

Huge iPhone Cut-and-Paste Tool Security Flaw 85

Posted by timothy from the a-sircam-you-can-pay-for dept.
Harry writes "I'm using Pastebud, the new third-party copy-and-paste solution for the iPhone. It's extremely clever, using a Web-based clipboard to get around the fact that Apple doesn't provide one on the phone. Unfortunately, it seems to be giving users access to e-mails that other Pastebud users send to their clipboards. This has happened to me repeatedly and is being reported by other users in Pastebud's Get Satisfaction support forum. Pastebud is operational and still doing this as I write, even though a message at Get Satisfaction says they're working on the problem."
This discussion has been archived. No new comments can be posted.

Huge iPhone Cut-and-Paste Tool Security Flaw More

Huge iPhone Cut-and-Paste Tool Security Flaw

Comments Filter:

  • You reap what you sow... (Score:5, Insightful)

    by An Ominous Cow Erred ( 28892 ) on Saturday December 13, 2008 @11:05PM (#26108359)

    ...well you *ARE* trusting a small, third party entity with your data on the internet. Can you really expect things that are not on storage you monitor yourself to be secure? Furthermore, why can't it just store your clipboard through local storage? Does it really have to put it up online? Do Apple's apps have no way to store and retrieve local data?

    Apple really should have this feature built in, but you shouldn't be surprised when your workaround that involves dumping your unencrypted data on a server somewhere has security issues.

    • Re: (Score:2, Informative)

      by Naurgrim ( 516378 )
      Ya, if I read this correctly, a quick scan of TFA (I know, not supposed to do that here) seems to indicate this is a *Pastebud problem, not an iPhone problem. Of course, if the iPhone does not have cut'n'paste, that's entirely another problem.

    • Re: (Score:3, Informative)

      by larry bagina ( 561269 )

      Apps are chrooted into their own directory structure, so they can't share data. But, yeah, this is people surprised to get what they should have expected.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Furthermore, why can't it just store your clipboard through local storage? Does it really have to put it up online?

      You're looking for OpenClip [openclip.org]. It's basically an open spec (well, as open as it can get under Apple's terms) for clipboards on the iPhone, and is supported by several applications. MagicPad is the notepad replacement that is written by the same folks.

      Do Apple's apps have no way to store and retrieve local data?

      iPhone applications have read-only access to the data of other applications. This prevents the creation of a single app that acts as a clipboard, since you can't (yet) have background apps.

      What OpenClip does is specify a standard location in each app for clipb

  • Response from their customer service (Score:1, Funny)

    by Anonymous Coward

    susan cant wat 2 get u hom + push ur butons

    o yah

    want me 2 pik up anythink @ groccery?

    --

    Sent from my iPhone

  • FROM TFA: (Score:5, Informative)

    by mdaitc ( 619734 ) on Saturday December 13, 2008 @11:19PM (#26108401)

    (NOTE: Jed Schmidt of Pastebud fixed the problem I discuss in this post yesterday night after I notified him about it. It affected only users-such as me-who misconfigured the service. Scroll down for details...)

    Harry,

    I've updated this issue over at Get Satisfaction[1], but let me just summarize what exactly was going wrong: you were inadvertently forwarding your emails not to your secret pastebud address, but to the address set as the from address for these emails, which was noreply@pastebud.com.

    This happened to other folks too; instead of sending email to secret-random-string@pastebud.com, they were sending to noreply@pastebud.com. And everyone who was doing this ended up sharing the same clipboard.

    Anyway, I just wanted to let you know that we've fixed it, and the changed will be live by the morning. You can find more details about the issue here[1].

    Thanks again for bringing this to our attention, and let me know if there's anything else you need clarification on.

    Jed Schmidt
    Founder, pastebud

    • Re:FROM TFA: (Score:5, Informative)

      by gcnaddict ( 841664 ) on Saturday December 13, 2008 @11:43PM (#26108515)
      So what you're trying to tell us is that this story...

      ...needs a usererror tag, right?

    • When will companies learn to disable 'noreply'? (Score:5, Interesting)

      by JSBiff ( 87824 ) on Sunday December 14, 2008 @12:56AM (#26108747) Journal

      Seems like every few months you hear yet another story about something bad happening because people are replying to or otherwise using a 'noreply' email address. Here's a clue - if you ever send emails to anyone from a 'noreply' address (or some other similar account name), you better make damn sure your servers are configured to not do something bad or stupid when unobservant users actually do reply to it.

      I will give them credit for this: *at least* it was noreply at their own domain. Too often, when you hear about this sort of thing, it's because a company did something like sending an email with a return address of 'noreply@donotreply.com' or something like that (where the domain is not their domain, and is a string which could potentially be registered by someone). I remember reading (ok, just found the story [washingtonpost.com] again) about a guy who had registered the domain 'donotreply.com' for yucks, and started getting all sorts of stuff like replies from Capital One bank customers, when Capital One sent some emails with the donotreply.com as the domain. (Sadly, the website www.donotreply.com where the guy used to blog about all the emails seems to be down now; wonder what happened to it - probably sunk by a lawsuit, or maybe the guy finally got bored of spending his free time reading thousands of emails).

      • Well, whois shows that donotreply.com is now registered to "Portal of Evil Inc". We can only guess what they are doing with all the Capital One passwords that they harvest.

        • Re: (Score:3, Funny)

          by redJag ( 662818 )
          Obviously this is some sort of Google service that is in beta..
        • Donotreply.com was one of the domains available for Portal of Evil's evilemail service... and "some guy" in this case is Chet Faliszek, who's actually with Valve these days. Ever hear of a little game called Portal?

        • Re: (Score:2)

          by neomunk ( 913773 )

          WAR KITTENS!

  • Already fixed, nothing to see. (Score:1)

    by Anonymous Coward

    Users misconfigured the app, and were sharing one big clipboard. Fixed on server side to stop bad users.

  • Why does it go to a server, anyway? (Score:4, Interesting)

    by The Amazing Fish Boy ( 863897 ) on Saturday December 13, 2008 @11:33PM (#26108463) Homepage Journal
    When I first heard of this trick, I thought it was pretty damn clever. But the way I'd imagined it from the headline was that it would use the mailto: pseudo-protocol to paste to Mail, and would use HTML5 client-side database [webkit.org] or a cookie of some sort to store it in the browser. My idea was basically three bookmarklets:
    1. Copy: Stores selected text in client-side database or cookie
    2. Paste: Pastes into text field in browser
    3. Paste to Mail: Opens a URL to mailto:replace@this.com?body=$clipboardContents

    Obviously this wouldn't work for copying from Mail to Safari, but I was kind of confused as to when that would come in handy anyway. The trade-off for security would be worth it, and if you really wanted to, you could still do a trip to a server for Mail-to-Safari copying.

    I haven't delved into the bookmarklets yet, so maybe it's not possible for some reason, but does anyone know why they would choose to have it make a trip to the server when it seems like it could be pretty easily avoided?

    • My God. How fucking horrible are -any- of these solutions?!? This one, a local one, whatever. They're all fucking horrible! All because The Steve says cut-n-paste is not for a touch screen phone. Ye gods. But apparently this is acceptable to the RDF'ed masses. I've read countless blog posts justifying the 'no cut and paste' as being a good idea, anything to require no admission of the fact that it's an ugly stupid and inexcusable UI flaw.

      • Re: (Score:3, Interesting)

        by furball ( 2853 )
        I have a hunch that Steve is looking for something a lot better than text copy-paste. Copy-paste done correctly is more complicated than you think it is.

        If I copy text, does it copy attributes? Does bold text retains its boldness? Etc.

        What happens when I want to copy an email address from the address book? Am I limited to copying read-only text or read-write text? Why can't I copy a whole address book entry? What happens when I paste the address book entry?

        • Re: (Score:1)

          by maxume ( 22995 )

          So why not start with unformatted text and build from there?

          Sure, it might be frustrating some of the time, but good luck convincing me that it is more frustrating than no copy/paste at all.

          • Re: (Score:3, Insightful)

            by db32 ( 862117 )

            That one is easy...Because that is what Microsoft does. They push out half completed bullshit products on their base and then say "well it will probably work right by the time SP2 comes along".

            Do it right the first time and don't put it out there until it is done right. Otherwise you fuck up your reputation. It is a lot harder to get the word out of "Hey, iPhone cut and paste is new and improved and actually works like it should now!" rather than "New iPhone 3.0! Now with Cut and Paste!". Most users are

            • If you had used an iPhone or iPod touch very much, you would have seen that it has a magnifying glass feature which is used to select your edit point when modifying a block of text. It works quite well, too. It seems to me like the magnifying glass would be a great way to mark your starting and ending selection points.

              • Re: (Score:2)

                by db32 ( 862117 )
                I have and that idea gives me nightmares. I dread screwing up enough that I need to use it. Nothing wrong with it, just a pain to get it in place. I think that cut and paste like that would often be far more trouble than it's worth.

            • Except your argument is mixed. Pushing out an OS without cut & paste is just as much a "half completed bullshit product" as pushing out cut & paste which is text-only.

              Which isn't to say that it's the wrong choice, necessarily. A knowledgeable user would have more functionality with text-only, but most of iPhone's customers aren't experts, we know. The argument needs to go deeper into why the boundary is where it is, because from the complaints about the lack of copy paste, we know that the iPhon

              • Re: (Score:2)

                by db32 ( 862117 )
                Well arguably yes. My point is that half assed features will cause worse outcomes than missing features. It is better to add new (complete) functionality than patching it together as you go. Aside from the reputation issues, what if you have to alter how it works to get it done. Now you have to deal with that whole retrain your users crap. (Fuck you Microsoft and your constant total interface redesigns! The first time you set up a wireless connection in Vista you may need antipsychotic meds afterwards

        • I have a hunch that Steve is looking for something a lot better than text copy-paste.

          So? I'm sure that he- along with lots of other companies- is, but that's no excuse for leaving the facility out altogether until something better comes along!

          • Re: (Score:3, Insightful)

            by Lars T. ( 470328 )

            I have a hunch that Steve is looking for something a lot better than text copy-paste.

            So? I'm sure that he- along with lots of other companies- is, but that's no excuse for leaving the facility out altogether until something better comes along!

            Well, the excuse is that others have done exactly that, and thus Windows (and a lot of other stuff) is full of interface quirks that are still in because people got so used to them they reject the better fix. Which (at least in the Windows case) results in some apps supporting only the old, some only the new, and some being forced to support both. Heck, apps supporting just one method will often use the other for something completely else. Yeah, a fine solution that is.

            Oh, you want an example? Try the keyb

            • Sorry, but I'm not buying that justification. Are you saying that no cut and paste is better than a flawed implementation, even if it's clear that Apple had- and have- nothing better in the pipeline?

              The iPhone has been out for 18 months now. In that time, there's been no official cut and paste facility, let alone an improved version! The simple truth is that Apple likely launched the cut-and-pasteless iPhone with nothing better planned for the forseeable future. (If they'd anything that was well-developed

        • This is already all taken care of in OS X, which the iPhone runs a subset of.

          This has more to do with Apple just deciding things for its users, than anything technical.

      • Re: (Score:3, Interesting)

        by Jay L ( 74152 ) *

        Not sure where you've read the countless defenses of lack-of-cut-and-paste, but Apple doesn't seem to agree. It's on their list; other things were higher on their list. I myself don't care about Exchange-server compatibility, and would MUCH rather have cut-and-paste. I'm sure others have their own personally-improved priority lists.

        I think Apple's done pretty well for an OS that's only 18 months out of the gate. Anything that new is bound to have some of what I call "unconscionably absent" features. I'

      • Re: (Score:1)

        by cwingrav ( 8705 )

        Get some sleep. It'll be alright... :)

      • Re: (Score:3, Insightful)

        by Sancho ( 17056 ) *

        I have an iPhone, and I use it regularly. There have been exactly two times when I wished that I had copy/paste. So no, I don't see what the big deal is. I don't think that lack of copy/paste was a good design decision--in fact, I'm sure that the phone would be better with it. But I don't think that it's a killer feature. I certainly don't think that the addition of copy/paste will make iPhone haters suddenly embrace the device--they'll just find something else to complain about.

        No phone is perfect. T

      • Re: (Score:2)

        by ivan256 ( 17499 )

        I don't know that I'd defend the lack of the feature as a "good idea", but I will say that I've had Copy and Paste on my phone (Treo 650/700) for years, and I've never used it. Not even once.

        Seems like a no-brainer type of feature to include, but if it went away on my phone, I can't say I'd miss it at all. The whole "issue" seems to be overblown.

  • Think different (Score:5, Funny)

    by lewko ( 195646 ) on Saturday December 13, 2008 @11:37PM (#26108487) Homepage

    a message at Get Satisfaction says they're working on the problem
    They've already done that.

    I suspect they should start working on a solution...

  • This should be reason enough for Apple to finally implement their own cut-and-paste functionality. Even if they aren't making the apps/bookmarklets that have these security breaches, the bad PR in general will drag them through the mud.

    • Re: (Score:3, Insightful)

      by ImNotAtWork ( 1375933 )
      My wife has been complaining about lack of a clipboard ever since she got the blasted thing. I tell her "I told you to wait for android every time she complains."

  • Terrible news about this Pastebud app.

    Hey, if you want your credit card information stored securely online, just IM me - I'll store it securely on a iPhone accessible website for ya.

  • Still no clipboard? (Score:5, Insightful)

    by erroneus ( 253617 ) on Sunday December 14, 2008 @02:18AM (#26109081) Homepage

    No wait... in ALL this time, Apple still hasn't provided this basic functionality?

    I wrote off the iPhone when I learned of the battery problem and haven't paid much attention to it since then. But one thing I expected to see resolved was the clipboard deficiency. I know some of my users were bouncing around happy when an update fixed some sync problem they were having and somehow among those fixes, I thought the clipboard feature was added, but I guess I was wrong.

    One thing I find ironic about iPhone is that Apple has somehow managed to restrict the convenience and basic functionality right out of the machine. I won't deny iPhone's extremely enthusiastic fanbase. It is rather incredible. But the coolest thing one user had to show was the zippo lighter. Yes, it looks and acts like a zippo lighter and serves no function at all. (Now when it lights a virtual cigarette on another iPhone, I will be impressed!) But I find it more than a little amazing that Copy and Paste are still not present.

    I think, perhaps, I understand why though. Apple may have created a security model that effectively prevents that from working -- even for themselves -- ever. If all apps, as I have read here, are chrooted to themselves and essentially shares nothing with the OS (which is somewhat hard to imagine...sharing nothing with the OS... how about some API code?) then it would seem that while security holes are effectively blocked forever, so too is basic functionality. Are iPhone apps not allowed to talk to a storage device that other iPhone apps are also allowed to talk to? It sounds like "no" since this paste program uses the inter-web to share data between apps. And what? This data isn't encrypted for individual users?

    • Re: (Score:1)

      by Leynos ( 172919 )

      I hear they still can't forward text messages either.

      Apple couldn't decide if the iPhone was supposed to be a phone or a computer, and in the end, it does neither particularly well.

      I think they did get a lot right tho in terms of user interface and design. I'd also like to develop for the platform. I'll be keeping my eyes on the iPhone to see if they get these failing eliminated in some future firmware release.

    • Comment removed based on user account deletion

    • You could be right about why. To be honest, I've never missed this functionality - the way I use the phone doesn't ever require copy paste. However while we're guessing, I'm guessing the reason it is missing is they couldn't develop a UI to copy/paste that was intuitive enough. How _do_ you copy/paste without a menu, some sort of special 'snip' gesture?

      Personally the biggest missing functionality for me is the inability to remember passwords/secure notes and requiring me to type them in on every visit. T

      • How _do_ you copy/paste without a menu

        how about if i press for say 2 seconds at the start of where i want to copy i get a draggable highlight? then i tap the highlighted text after dragging to the end point and it copies. at the other end of the process, how about i hold down for 3 seconds to paste?

        seriously, for all the things my iPhone does, i'm still amazed it DOESN'T do cut and paste. Coming from a blackberry, which does cut and paste, i probably notice the lack of it more. it's easy for people

Slashdot Top Deals

May the bluebird of happiness twiddle your bits.

Close