>It seems like a ton of apps are abusing this feature: https://www.youtube.com/watch?v=pRSWdtoUAjo
Okay, this could be simply a dynamic link library checking for a deep link in the clipboard.
Why do this? To preserve the state after install.
Firebase does it. When you click on a deep link but you don't have the app installed, the webpage would copy the url to clipboard and open the App Store, after you install the app and open it Firebase would check the clipboard and take you to the the correct screen.
The apps in the video don't need to be malicious, they simply could be checking if there's a deep link in the clipboard to restore user session.
Of course, with iOS 14 the best practice would be to do this only once after the install.
That's all well and good, but as a privacy-conscious user I still want to (a) know about it and (b) be able to control/disable it.
Wait of apps can use clipboard to track me from Safari into their app then I’m super glad I get notified about that now!
... what?
Yes? That's the definition of a deep link? The way you get notified is you open their app...
This is a special case when you don't already have the app installed, but being able to read the clipboard without warning is it's own thing, but this specific deep link use-case is extremely benign...
Ideally, we’d be able to differentiate between local parsing (which I’d deem acceptable) and a remote request, but that quickly enters a gray area. How long after parsing do we validate a request? Is it even viable for a compiler to track the status of a property beyond assignment? And for how long? etc.