3 ms·

People who use password managers tend to use the clipboard to copy the passwords around. I assume those passwords are also available in these apps?

gelatocar 11y ago
That is kinda worrying, though I don't use that functionality myself. Is there another way that passwords could be passed between apps without using the clipboard?
- TeMPOraL 11y ago
  Maybe there could be a way to negotiate a secure channel between a browser and password manager. Say, when setting up, a browser gives you a key to retype into password manager, and then it's used to encrypt the password before putting it in the clipboard. Adds one more step for setting things up but saves the clipboard as a whole. People using password managers are already people willing to jump through some hoops to set things up, adding one more hoop shouldn't make things worse.
- toomuchtodo 11y ago
  Have the password management app emulate a custom keyboard?
  - sratner 11y ago
    Keepass2Android does exactly that, and additionally auto-fills password and confirmation fields when you focus them with the custom keyboard active. Very handy. (https://play.google.com/store/apps/details?id=keepass2android.keepass2android&hl=en https://play.google.com/store/apps/details?id=keepass2androi...)
  - bruceboughton 11y ago
    iOS disables custom keyboards for password fields, which is a great idea in most scenarios. This is what prevents Agilebits building a 1Password keyboard extension.
johncolanduoni 11y ago
At least 1Password on iOS can fill logins directly into Safari. It is (somewhat confusingly) listed as an action when you click the "share" icon.
nell 11y ago
1Password has a TTL setting to clear passwords copied to clipboards. They've thought this through. Kudos.
- masklinn 11y ago
  Probably doesn't work anymore, as conradev notes[0], applications used to have clipboard access when running from the background (so after TTL expires 1password could go in, check if clipboard data was still the password and remove it even if not active) but that's not the case in ios9, only the currently active application can access the clipboard. So unless apple added TTL to clipboard items (which UIPasteboard's documentation doesn't indicate) it won't work anymore. [0] https://news.ycombinator.com/item?id=10411166 https://news.ycombinator.com/item?id=10411166

gelatocar 11y ago

That is kinda worrying, though I don't use that functionality myself. Is there another way that passwords could be passed between apps without using the clipboard?

TeMPOraL 11y ago
Maybe there could be a way to negotiate a secure channel between a browser and password manager. Say, when setting up, a browser gives you a key to retype into password manager, and then it's used to encrypt the password before putting it in the clipboard. Adds one more step for setting things up but saves the clipboard as a whole. People using password managers are already people willing to jump through some hoops to set things up, adding one more hoop shouldn't make things worse.
toomuchtodo 11y ago
Have the password management app emulate a custom keyboard?
- sratner 11y ago
  Keepass2Android does exactly that, and additionally auto-fills password and confirmation fields when you focus them with the custom keyboard active. Very handy. (https://play.google.com/store/apps/details?id=keepass2android.keepass2android&hl=en https://play.google.com/store/apps/details?id=keepass2androi...)
- bruceboughton 11y ago
  iOS disables custom keyboards for password fields, which is a great idea in most scenarios. This is what prevents Agilebits building a 1Password keyboard extension.

johncolanduoni 11y ago

At least 1Password on iOS can fill logins directly into Safari. It is (somewhat confusingly) listed as an action when you click the "share" icon.

nell 11y ago

1Password has a TTL setting to clear passwords copied to clipboards. They've thought this through. Kudos.

masklinn 11y ago
Probably doesn't work anymore, as conradev notes[0], applications used to have clipboard access when running from the background (so after TTL expires 1password could go in, check if clipboard data was still the password and remove it even if not active) but that's not the case in ios9, only the currently active application can access the clipboard. So unless apple added TTL to clipboard items (which UIPasteboard's documentation doesn't indicate) it won't work anymore. [0] https://news.ycombinator.com/item?id=10411166 https://news.ycombinator.com/item?id=10411166