Hacker News Reader

Comment by ramraj07 | Hacker News Reader

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

View on HN

I'm still utterly perplexed about why every major operating system handles the clipboard this way. It's such an obvious privacy issue, and the fix seems really simple: only allow clipboard access when the user explicitly grants access through a system-provided user interface (whether that be a dialogue box, menu item or keyboard shortcut)

Apple's iOS 14 uses the half-solution of notifying the user after an application has read the clipboard. But at that point the end user is already a step behind the attacker, and mitigations may no longer be possible. Nevermind that this solution is dependant on the user noticing and understanding the implications of the clipboard access notification (the novice user is likely oblivious to the security risks)

Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?

On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.

That's paste

It looks like paste and it's almost the same from the user perspective, but the data never makes it to the clipboard, where it would be available to every running application.

From what I can see, KeePass does use the clipboard. [0]

[0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/N...

Sorry, I didn't mean to speak with any authority on the specifics of KeePass. I'm neither a developer nor a user. I was just explaining the parent.

That said, the implementation probably differs on different platforms. 1Password, for example, uses a virtual "keyboard" on Android.

That's a different option (CTRL-C). You can copy and paste the username and password. There's a default clearing timeout that's more to ensure the user doesn't accidentally paste it elsewhere. The auto-type option I mentioned is different.

> The auto-type option I mentioned is different.

It actually falls back to the clipboard [0], in a huge number of situations [1]. Basically, if Windows Forms isn't available/reliable.

[0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U...

[1] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U...

> No extensions or clipboard required.

Paste draws from the clipboard.

You’re confusing console paste with windows paste

Yep, now I get it. Some addon does this override

I tried using this but the final "enter" made me too uncomfortable. I really wish it was optional so I could verify where it just typed the password before submitting. After accidentally sending my password in the wrong field/window a couple of times I stopped using it entirely. Now I just copy-paste :(

You can edit how and what KeePass types, I always remove the final enter for comfort and safety reasons.

Ah wow, thanks for the tip. I guess you can edit the root group to change it globally? Thanks, I'll try this.

keepassxc has extra options in the auto-type menu for "username", "username<enter>", "password" and "password<enter>" in addition to the normal "username<tab>password<enter>"

Xkcd to the rescue? https://xkcd.com/936/

Gfycat already generates memorable URLs so it’s definitely possible. I myself do it manually nowadays (ie generate phrase password to be stored in manager so I can copy it manually if needed)

Use a browser extension. For example, the 1Password extension uses (authenticated) IPC to talk to the app and then injects the password into the DOM directly.

Reply on news.ycombinator.com