5 ms·

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

MontagFTB 6y ago
Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?
- JohnTHaller 6y ago
  On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.
  - edoceo 6y ago
    That's paste
    - sjs382 6y ago
      It looks like paste and it's almost the same from the user perspective, but the data never makes it to the clipboard, where it would be available to every running application.
      - shakna 6y ago
        From what I can see, KeePass does use the clipboard. [0] [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Native/ClipboardU.cs https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/N...
        sjs382 6y ago
        Sorry, I didn't mean to speak with any authority on the specifics of KeePass. I'm neither a developer nor a user. I was just explaining the parent. That said, the implementation probably differs on different platforms. 1Password, for example, uses a virtual "keyboard" on Android.
        JohnTHaller 6y ago
        That's a different option (CTRL-C). You can copy and paste the username and password. There's a default clearing timeout that's more to ensure the user doesn't accidentally paste it elsewhere. The auto-type option I mentioned is different.
        shakna 6y ago
        > The auto-type option I mentioned is different. It actually falls back to the clipboard [0], in a huge number of situations [1]. Basically, if Windows Forms isn't available/reliable. [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Utility/MonoWorkarounds.cs#L288 https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U... [1] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Utility/MonoWorkarounds.cs#L61 https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U...
    - thaumasiotes 6y ago
      > No extensions or clipboard required. Paste draws from the clipboard.
      - whitexn--g28h 6y ago
        You’re confusing console paste with windows paste
        edoceo 6y ago
        Yep, now I get it. Some addon does this override
  - ludocode 6y ago
    I tried using this but the final "enter" made me too uncomfortable. I really wish it was optional so I could verify where it just typed the password before submitting. After accidentally sending my password in the wrong field/window a couple of times I stopped using it entirely. Now I just copy-paste :(
    - Moeg 6y ago
      You can edit how and what KeePass types, I always remove the final enter for comfort and safety reasons.
      - ludocode 6y ago
        Ah wow, thanks for the tip. I guess you can edit the root group to change it globally? Thanks, I'll try this.
    - PowerBar 6y ago
      keepassxc has extra options in the auto-type menu for "username", "username<enter>", "password" and "password<enter>" in addition to the normal "username<tab>password<enter>"
- ramraj07 6y ago
  Xkcd to the rescue? https://xkcd.com/936/ https://xkcd.com/936/ Gfycat already generates memorable URLs so it’s definitely possible. I myself do it manually nowadays (ie generate phrase password to be stored in manager so I can copy it manually if needed)
- Hackbraten 6y ago
  Use a browser extension. For example, the 1Password extension uses (authenticated) IPC to talk to the app and then injects the password into the DOM directly.
spideymans 6y ago
I'm still utterly perplexed about why every major operating system handles the clipboard this way. It's such an obvious privacy issue, and the fix seems really simple: only allow clipboard access when the user explicitly grants access through a system-provided user interface (whether that be a dialogue box, menu item or keyboard shortcut) Apple's iOS 14 uses the half-solution of notifying the user after an application has read the clipboard. But at that point the end user is already a step behind the attacker, and mitigations may no longer be possible. Nevermind that this solution is dependant on the user noticing and understanding the implications of the clipboard access notification (the novice user is likely oblivious to the security risks)
- deleted 6y ago
  [deleted]

MontagFTB 6y ago

Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?

JohnTHaller 6y ago
On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.
- edoceo 6y ago
  That's paste
  - sjs382 6y ago
    It looks like paste and it's almost the same from the user perspective, but the data never makes it to the clipboard, where it would be available to every running application.
    - shakna 6y ago
      From what I can see, KeePass does use the clipboard. [0] [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Native/ClipboardU.cs https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/N...
      - sjs382 6y ago
        Sorry, I didn't mean to speak with any authority on the specifics of KeePass. I'm neither a developer nor a user. I was just explaining the parent. That said, the implementation probably differs on different platforms. 1Password, for example, uses a virtual "keyboard" on Android.
      - JohnTHaller 6y ago
        That's a different option (CTRL-C). You can copy and paste the username and password. There's a default clearing timeout that's more to ensure the user doesn't accidentally paste it elsewhere. The auto-type option I mentioned is different.
        shakna 6y ago
        > The auto-type option I mentioned is different. It actually falls back to the clipboard [0], in a huge number of situations [1]. Basically, if Windows Forms isn't available/reliable. [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Utility/MonoWorkarounds.cs#L288 https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U... [1] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Utility/MonoWorkarounds.cs#L61 https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U...
  - thaumasiotes 6y ago
    > No extensions or clipboard required. Paste draws from the clipboard.
    - whitexn--g28h 6y ago
      You’re confusing console paste with windows paste
      - edoceo 6y ago
        Yep, now I get it. Some addon does this override
- ludocode 6y ago
  I tried using this but the final "enter" made me too uncomfortable. I really wish it was optional so I could verify where it just typed the password before submitting. After accidentally sending my password in the wrong field/window a couple of times I stopped using it entirely. Now I just copy-paste :(
  - Moeg 6y ago
    You can edit how and what KeePass types, I always remove the final enter for comfort and safety reasons.
    - ludocode 6y ago
      Ah wow, thanks for the tip. I guess you can edit the root group to change it globally? Thanks, I'll try this.
  - PowerBar 6y ago
    keepassxc has extra options in the auto-type menu for "username", "username<enter>", "password" and "password<enter>" in addition to the normal "username<tab>password<enter>"
ramraj07 6y ago
Xkcd to the rescue? https://xkcd.com/936/ https://xkcd.com/936/ Gfycat already generates memorable URLs so it’s definitely possible. I myself do it manually nowadays (ie generate phrase password to be stored in manager so I can copy it manually if needed)
Hackbraten 6y ago
Use a browser extension. For example, the 1Password extension uses (authenticated) IPC to talk to the app and then injects the password into the DOM directly.

spideymans 6y ago

I'm still utterly perplexed about why every major operating system handles the clipboard this way. It's such an obvious privacy issue, and the fix seems really simple: only allow clipboard access when the user explicitly grants access through a system-provided user interface (whether that be a dialogue box, menu item or keyboard shortcut) Apple's iOS 14 uses the half-solution of notifying the user after an application has read the clipboard. But at that point the end user is already a step behind the attacker, and mitigations may no longer be possible. Nevermind that this solution is dependant on the user noticing and understanding the implications of the clipboard access notification (the novice user is likely oblivious to the security risks)

deleted 6y ago
[deleted]