Show HN: A cross platform app for mirroring the clipboard between synced devices | Hacker News Reader

Show HN: A cross platform app for mirroring the clipboard between synced devices

github.com

57 pointstiagovtristao29 comments

Clipboard contents is a very sensitive data stream. People copy and paste all sorts of passwords, credit card data, command lines, confidential text etc. I once found the domain password of a coworker in the clipboard, simply because we were sharing a VNC session; so when I pasted the text data I immediately recognized it as a password. If this can happen accidentally, I think logging this data stream on the long run is equivalent to full compromise and can spread malware or worse in the internal network.

An easy active attack I could envision is to listen on the remote clipboard for something that looks like a long Unix or Windows command line, which the remote user lifted from a tutorial or some such. Malware would immediately trigger a sync event to modify the remote clipboard and insert a loader for itself, obfuscated somewhere within that command line. So from the time you copy to the time you paste and press enter, the machine is rooted, unless you carefully review that command line before execution.

Agree, the clipboard contains a treasure trove of sensitive information.

Sounds like a security issue waiting to happening.

Every interesting thing you can do with computers is a security issue waiting to happen. The only secure computer is one that's disconnected from Internet, turned off, encased in concrete and buried in an abandoned mine, which is then flooded and sealed with more concrete.

Point being, while this particular implementation needs a lot more work, the concept itself is sound.

How does you application prevent MitM attacks?

Does not look like it even tries:

"The features missing to make it to a secure and stable version are:" ... "The JSON RPC server should be serving HTTPS instead HTTP."

great, so it's an app that broadcasts your clipboard contents to all bad guys on your network.

Nice. This is the best example I give for why Macs are great. Because they think about these things. This is a built in functionality in the Apple ecosystem.

FWIW this is in KDE (via kdeconnect) too; I have it turned off. The only use case I personally have is copying passwords. In what way do you use it?

Also a feature of Windows 10 afaik. Possibly only an insider preview update.

On my Macs + iPhone the biggest use by far is for TOTP 2FA codes. Open app on iPhone, tap the right code, paste in field on Mac.

Usually copy pasting links/messages/images between desktop and mobile.

The difference is, speaking of Apple it's iPhone/iPad + Mac, which is super-useful, I don't even know how can you ask for a use-case, since everything is a use-case: copy anything from your phone to a computer, be it a text, an url, phone number, quote from a book/article you were reading. And speaking of KDE, it's just one KDE PC + another KDE PC, which is basically useless, since it's a rare person nowadays to be walking around with a KDE PC in his pocket.

So, yeah, I kinda hate Apple (I like my stuff configurable), but I wonder more and more how long is it until I drop other devices/OS', and buy an iPhone + MacBook.

KDE connect has an Android app that does this and most of the other stuff I assume Apple enables; I don't use Apple products, because I use Arch and Android.

Yep, KDE Connect is fantastic. I was really thrilled when after installing the mpris extension for Mopidy, I was able to see the current track playing, including album art, and pause/play with zero latency. That's just the icing on the cake of notification and clipboard mirroring.

No difference, it's KDE + android. Not only it has bidirectional clipboard syncing (so copy a 2FA token from the mobile to the PC) but also other nice features. Like if your phone is ringing, your PC will pause automatically YouTube or play music / spotify tabs on chrome. You can control PC media (e.g. again play music on chrome) from your phone, sync notifications uni or bidirectional, share/browse files, use the phone as a trackpad or keyboard for the PC, answer messages from the PC, etc.

Wow, that was a stupid mistake on my part. I don't know why I was convinced it doesn't work with Android. It is indeed really awesome.

And speaking of KDE, it's just one KDE PC + another KDE PC, which is basically useless, since it's a rare person nowadays to be walking around with a KDE PC in his pocket.

Nah. It's any Linux computer [0] <-> Android [1].

[0] KDE Connect works on Gnome as well.

[1] It can connect to any Android device as it has an Android app.

And as other's have commented, it has many more features than just the clipboard.

I'm using an iphone now and the biggest thing I miss from Android is KDE Connect which is not available on iOS.

I use the remote control feature to annoy my son - use phone as touchpad - but as Firefox can already sync my browser usage I don't need to move stuff around.

You can copy phone numbers, quotes, etc., I just never do. Given you can cloud store all of it, why bother with manual local sync.

In short it seems cool, just doesn't fit any workflow I use so I was curious what THEIR use case was.

These things keep coming now and then on HN. I built one myself[1] long time back and this makes me wonder if there is actually a market for clipboard mirroring.

[1] https://github.com/krishnaraj/oneclipboard

Pushbullet seems to be doing alright

Thank you. It's useful when I have multiple virtual machines open in my PC and something this simple is really nice.

anything lightweight that pastes only on demand via a shortcut? i don't feel good about syncing everything

Wana write a blog post about the this?

Encryption should be part of the MVP.

Did this need to be an electron app??

It says right on the github page:

"Electron could be switched by native APIs since it's overkill for such a small program."

Perhaps read before snarking.

I wasn't 'snarking' I asked a question, for what it's worth I was reading this on my Phone and didn't read the entire thing because it took too long to load for me.

Reply on news.ycombinator.com