1

Upon reading TikTok says it will stop accessing clipboard content on iOS devices, I wonder: How can I see which applications is reading the clipboard?

2
  • If your device is rooted, and you use Xposed: XPrivacyLua shows such things (if an app has tried to access, and if so how often and what time last). – Izzy Jun 26 '20 at 22:17
  • 1
    Use AppOps to get status of operation READ_CLIPBOARD like this: android.stackexchange.com/a/215658/218526 – Irfan Latif Jun 27 '20 at 17:11
1
  • Prior to Android 10, all apps could access clipboard by default without even asking for permission. Apps actually need a permission (that is automatically granted) to read the clipboard: READ_CLIPBOARD (from XDA Developers) - thanks to Andrew in comment

  • In Android 10, See Privacy changes in Android 10, access to clipboard is limited to OEM apps only that have READ_CLIPBOARD_IN_BACKGROUND permission, which are keyboards and "apps in focus" (not sure what latter means)

Unless your app is the default input method editor (IME) or is the app that currently has focus, your app cannot access clipboard data on Android 10 or higher

  • TikTok would need to ask and be granted the same signature as OS since this permission is Signature permission

The system grants these app permissions at install time, but only when the app that attempts to use a permission is signed by the same certificate as the app that defines the permission.

3
  • 1
    In this kind of context "app in focus" should mean the app that's actively in use and displayed on the screen. Classically in OS jargon & programming "in focus" is referring to whatever is currently capturing user input. – l3l_aze Jun 27 '20 at 4:59
  • @l3l_aze My confusion is more with the question - does any app that has focus gain access to clipboard? Answer according to me is yes but not sure – beeshyams Jun 27 '20 at 5:13
  • 1
    Ohh, I think I'm with you now. Signature Permissions (Ctrl + f data sharing through permissions) says: it allows apps to share code & data provided they're both signed with the same public key certificate (which is generated by devs). These are attached to apps by apksigner, so I don't believe the signatures could be OEM to the OS and the app wouldn't be given the special BACKGROUND permission except maybe if it's pre-installed (but IDK personally). Any app with focus will have access by default, based on your quote above. – l3l_aze Jun 27 '20 at 6:52
1

We can do some scripting with AppOps.

Create /sdcard/clipboard_history.sh:

for pkg in $( pm list packages | sed 's/package://' )
do
    ( appops get $pkg READ_CLIPBOARD; appops get $pkg WRITE_CLIPBOARD ) |
    grep -i time= |
    while read -r line
    do
        echo $line | grep ' allow; ' | sed 's/time=+//'
        echo $line | grep -v ' allow; ' | sed 's/time=+[^ ]*//; s/rejectTime=+//'
    done |
    sed 's/[0-9]*ms//; s/[:;]//g; s/_CLIPBOARD//; s/ago//g; s/$/& '"$pkg"'/'
done |
awk '{printf "%-10s%-14s%-20s%s\n",$1,$2,$3,$4}'

Run:

~$ adb shell sh /sdcard/clipboard_history.sh
WRITE     allow         19h48m7s            org.shadowice.flocke.andotp
READ      allow         2d1h46m12s          dev.ukanth.ufirewall
READ      ignore        26m16s              com.dv.adm.old
READ      deny          7h39m16s            com.google.android.gms
READ      foreground-R  1d2h43m6s           org.blackmart.market
WRITE     allow         6m48s               com.termux
READ      foreground    16s                 com.google.android.inputmethod.latin
READ      allow         1m17s               com.stackexchange.marvin
WRITE     allow         1m14s               com.stackexchange.marvin

Similar answer here: Is there a way to log calls to device vibrator?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.