9 ms·

People seem pretty upset about their clipboards, I wonder if apple/google will listen and make the reading of your clipboard something that you must get explici

People seem pretty upset about their clipboards, I wonder if apple/google will listen and make the reading of your clipboard something that you must get explicit user permission for (similar to your camera). IMO this is how almost every possibly permission should be and I think most users would agree with me that having 2 seconds of inconvenience when you first setup the app is worth the peace of mind gained.

LoSboccacc 6y ago
it should be split into "local clipboard" and "global clipboard" so that you still have copy paste within the program but paste outside the program require privilege there's plenty Android sketch/mind mapping apps for example that require access to storage, for saving and exchanging media, and the is doesn't allow for "allow access to some folder without giving them access to everything" and it's annoying most permissions actually should have that kind of don't allow global access without breaking the app functionality or even telling the app itself
- bluedino 6y ago
  BlackBerry Work (for iOS and Android) can work with solely the clipboard inside the app
- fencepost 6y ago
  This. There are plenty of situations where I'd be happy with allowing an app to store its own internal data and maybe export local backups but I don't want to give permission to enumerate and read everything on the file system. Heck, I'm using Bouncer to remove permissions after I move away from apps. I fail to understand why more granular permissions haven't been a priority.
- smichel17 6y ago
  There's no problem if I manually copy some text from a box in one app and paste it into another app, and I don't want a permission prompt for that. It's programmatic access that I care about (apps snooping clipboard content). Technically they could probably be implemented the same way and the "manual" action is actually just granting the programmatic permission to the keyboard app.
  - deleted 6y ago
    [deleted]
  - behringer 6y ago
    The copy and paste button in all apps is programmatic. Windows can't tell the difference, for example, if a user copied from edit > copy or if the website did it itself. It could work if windows had a copy paste api with levels of access and trusted the apps to honor the access level. Then the browser could tell windows if a user clicked paste or if a website did.
    - willis936 6y ago
      I argue that the clipboard shouldn’t be given any extra levels of trust because it’s current level of trust, very low, is the correct amount.
      - filleduchaos 6y ago
        Precisely! It's the rough equivalent of a tempfile in your home directory, I don't know why even developers have come to view it like it's some super secure and private kernel component.
      - behringer 6y ago
        That's all well and good, unless you're an attorney, author, document writer, research scientist, or literally anybody who types a lot... At jobs I've literally copy PHI all over the place for data processing. Copy and paste is vital and often top secret.
        willis936 6y ago
        It’s a bad shaped tool for that problem. It’s a shared resource. There is a gaping hazard where any other piece of software can change the data you want to read before you can read it. Use a database.
        6y ago
amiga_500 6y ago
It's not just passwords. Imagine if you were writing an email to a close friend, about looking for a new job because you think your boss is incompetent. You copy and paste it for some reason (reformatting, whatever). You do not want that to be seen by a job network site that has you connected to your boss.
newsbinator 6y ago
I'd even accept a step during OS initialization, when it could ask something like: "how much do you care about various apps being able to read your clipboard?" 1. I care a lot: I want to be asked every single time whether I approve of my clipboard getting read. 2. I care a moderate amount: ask me the first time an app tries it, then stop asking me for a while. 3. I don't care: let apps do whatever they want. I'll let other people worry about my security. (albeit phrased more diplomatically, of course)
- captn3m0 6y ago
  That’s what UAC tried. Didn’t work that well in practice.
gentleman11 6y ago
It should just work the way that every user assumes it works: apps can’t read it at all, but the user can explicitly paste from it
- willis936 6y ago
  Right? On what planet should an app be allowed to read or write to the clipboard? The only piece of software that should access the clipboard is the keyboard, and even that I have trouble trusting with all of these predictive services. I’d like to feel more confident that my most used device isn’t loaded up with keyloggers.
  - deleuze 6y ago
    Write to clipboard makes sense for "click to copy" functionality. It's a small ergonomic improvement but doesn't seem like the same security risk as reading from the clipboard.
  - Denvercoder9 6y ago
    On Android, one of the suggestions when you focus the address bar in Chrome is the URL currently on your clipboard. That's tremendously useful. (It helps that pasting isn't especially ergonomic on Android.)
    - cannedslime 6y ago
      To be honest I hate that they have gimped the address bar on android chrome. Its just one more button press if i need to edit the url, and i think its creepy that they read the clipboard to be frank.
      - Denvercoder9 6y ago
        I replace the address more often than I edit it, so personally I like it. But yes, reception has certainly been mixed.
    - RobLach 6y ago
HeadsUpHigh 6y ago
How about not letting them read the clipboard at all. They don't need it.

LoSboccacc 6y ago

it should be split into "local clipboard" and "global clipboard" so that you still have copy paste within the program but paste outside the program require privilege there's plenty Android sketch/mind mapping apps for example that require access to storage, for saving and exchanging media, and the is doesn't allow for "allow access to some folder without giving them access to everything" and it's annoying most permissions actually should have that kind of don't allow global access without breaking the app functionality or even telling the app itself

bluedino 6y ago
BlackBerry Work (for iOS and Android) can work with solely the clipboard inside the app
fencepost 6y ago
This. There are plenty of situations where I'd be happy with allowing an app to store its own internal data and maybe export local backups but I don't want to give permission to enumerate and read everything on the file system. Heck, I'm using Bouncer to remove permissions after I move away from apps. I fail to understand why more granular permissions haven't been a priority.
smichel17 6y ago
There's no problem if I manually copy some text from a box in one app and paste it into another app, and I don't want a permission prompt for that. It's programmatic access that I care about (apps snooping clipboard content). Technically they could probably be implemented the same way and the "manual" action is actually just granting the programmatic permission to the keyboard app.
- deleted 6y ago
  [deleted]
- behringer 6y ago
  The copy and paste button in all apps is programmatic. Windows can't tell the difference, for example, if a user copied from edit > copy or if the website did it itself. It could work if windows had a copy paste api with levels of access and trusted the apps to honor the access level. Then the browser could tell windows if a user clicked paste or if a website did.
  - willis936 6y ago
    I argue that the clipboard shouldn’t be given any extra levels of trust because it’s current level of trust, very low, is the correct amount.
    - filleduchaos 6y ago
      Precisely! It's the rough equivalent of a tempfile in your home directory, I don't know why even developers have come to view it like it's some super secure and private kernel component.
    - behringer 6y ago
      That's all well and good, unless you're an attorney, author, document writer, research scientist, or literally anybody who types a lot... At jobs I've literally copy PHI all over the place for data processing. Copy and paste is vital and often top secret.
      - willis936 6y ago
        It’s a bad shaped tool for that problem. It’s a shared resource. There is a gaping hazard where any other piece of software can change the data you want to read before you can read it. Use a database.
        6y ago

amiga_500 6y ago

It's not just passwords. Imagine if you were writing an email to a close friend, about looking for a new job because you think your boss is incompetent. You copy and paste it for some reason (reformatting, whatever). You do not want that to be seen by a job network site that has you connected to your boss.

newsbinator 6y ago

I'd even accept a step during OS initialization, when it could ask something like: "how much do you care about various apps being able to read your clipboard?" 1. I care a lot: I want to be asked every single time whether I approve of my clipboard getting read. 2. I care a moderate amount: ask me the first time an app tries it, then stop asking me for a while. 3. I don't care: let apps do whatever they want. I'll let other people worry about my security. (albeit phrased more diplomatically, of course)

captn3m0 6y ago
That’s what UAC tried. Didn’t work that well in practice.

gentleman11 6y ago

It should just work the way that every user assumes it works: apps can’t read it at all, but the user can explicitly paste from it

willis936 6y ago
Right? On what planet should an app be allowed to read or write to the clipboard? The only piece of software that should access the clipboard is the keyboard, and even that I have trouble trusting with all of these predictive services. I’d like to feel more confident that my most used device isn’t loaded up with keyloggers.
- deleuze 6y ago
  Write to clipboard makes sense for "click to copy" functionality. It's a small ergonomic improvement but doesn't seem like the same security risk as reading from the clipboard.
- Denvercoder9 6y ago
  On Android, one of the suggestions when you focus the address bar in Chrome is the URL currently on your clipboard. That's tremendously useful. (It helps that pasting isn't especially ergonomic on Android.)
  - cannedslime 6y ago
    To be honest I hate that they have gimped the address bar on android chrome. Its just one more button press if i need to edit the url, and i think its creepy that they read the clipboard to be frank.
    - Denvercoder9 6y ago
      I replace the address more often than I edit it, so personally I like it. But yes, reception has certainly been mixed.
  - RobLach 6y ago

HeadsUpHigh 6y ago

How about not letting them read the clipboard at all. They don't need it.