4 ms·

Ouch, that sounds like something that should have a permission. Permission for background or programmatic access, none needed to receive pastes initiated by use

by m_eiman 10y ago

Ouch, that sounds like something that should have a permission. Permission for background or programmatic access, none needed to receive pastes initiated by user seems reasonable IMHO.

dfox 10y ago
That would require reliably deciding whether the action was in fact initiated by user, which is hard in browser environment and probably impossible for android.
- poizan42 10y ago
  The answer to that may actually be quite simple: The keyboard app is the one that should be allowed to read from the clipboard. Now can a keyboard spy on you clipboard contents? Sure. But it can also spy on all your keystrokes, so the trust must already be there.
  - dfox 10y ago
    That assumes that clipboard can only contain text, which I'm not sure whether is so on Android, but on all major desktop UI systems clipboard can not only contain arbitrary data, but even allows for negotiation of supported formats between source and destination.
candiodari 10y ago
But, that's done on websites as well, and frankly it's annoying. Giving apps the ability to put stuff into the clipboard and extract it out again has been made too hard (and one of the few remaining applications of flash). I'd even settle for the ability to put stuff in the clipboard programmatically ... This is a case of overly broad security imho.
- ploggingdev 10y ago
  > But, that's done on websites as well Can websites running in background tabs access the clipboard contents on the Desktop?
  - btown 10y ago
    The spec says no, but there's no guarantee that a browser implementation doesn't "through an implementation-dependent mechanism" give this access by default. https://www.w3.org/TR/clipboard-apis/#event-handlers-that-are-allowed-to-read-from-clipboard https://www.w3.org/TR/clipboard-apis/#event-handlers-that-ar...
  - emodendroket 10y ago
    In my experience browsers won't let you see the clipboard at all unless the user initiates a paste event.

by m_eiman 10y ago

Ouch, that sounds like something that should have a permission. Permission for background or programmatic access, none needed to receive pastes initiated by user seems reasonable IMHO.

dfox 10y ago

That would require reliably deciding whether the action was in fact initiated by user, which is hard in browser environment and probably impossible for android.

poizan42 10y ago
The answer to that may actually be quite simple: The keyboard app is the one that should be allowed to read from the clipboard. Now can a keyboard spy on you clipboard contents? Sure. But it can also spy on all your keystrokes, so the trust must already be there.
- dfox 10y ago
  That assumes that clipboard can only contain text, which I'm not sure whether is so on Android, but on all major desktop UI systems clipboard can not only contain arbitrary data, but even allows for negotiation of supported formats between source and destination.

candiodari 10y ago

But, that's done on websites as well, and frankly it's annoying. Giving apps the ability to put stuff into the clipboard and extract it out again has been made too hard (and one of the few remaining applications of flash). I'd even settle for the ability to put stuff in the clipboard programmatically ... This is a case of overly broad security imho.

ploggingdev 10y ago
> But, that's done on websites as well Can websites running in background tabs access the clipboard contents on the Desktop?
- btown 10y ago
  The spec says no, but there's no guarantee that a browser implementation doesn't "through an implementation-dependent mechanism" give this access by default. https://www.w3.org/TR/clipboard-apis/#event-handlers-that-are-allowed-to-read-from-clipboard https://www.w3.org/TR/clipboard-apis/#event-handlers-that-ar...
- emodendroket 10y ago
  In my experience browsers won't let you see the clipboard at all unless the user initiates a paste event.