5 ms·
To all of you who stopped worrying thanks to a clipboard manager, how do you handle sensitive contents in your clipboard? For example, I routinely copy-paste m
by Rygian 5y ago
To all of you who stopped worrying thanks to a clipboard manager, how do you handle sensitive contents in your clipboard?
For example, I routinely copy-paste my passwords from KeePass, and I have disabled all clipboard management to avoid copies of my passwords lingering around.
- dmortin 5y agoIf you copy your password then use it and then delete the item from the clipboard manager manually.
- Rygian 5y agoI seem to have drifted to the exact opposite: no clipboard manager, and when I want to cut/copy something and have it persist for longer, I just paste it in a notepad application. I copy/paste passwords much more often than I require multiple clipboard entries alive together.
- WayToDoor 5y agoAt least on MacOS "sensitive" contents copied to clipboard by apps can be marked as such, and won't be persisted by my clipboard manager.
- BoardsOfCanada 5y agoWhich clipboard manager do you use?
- tuxone 5y agoI see this happening also with the default clipboard manager in windows and 1password - copied passwords do not show up in the clipboard menu (downside they are not pastable in VMs either)
- egeozcan 5y agoI wonder what API they use, in the .NET API I don't see any option to set content as sensitive: https://docs.microsoft.com/en-us/dotnet/api/system.windows.clipboard?view=windowsdesktop-6.0 https://docs.microsoft.com/en-us/dotnet/api/system.windows.c... edit: ah, nevermind, it's just not exposed to .NET, search for "CanIncludeInClipboardHistory" here: https://docs.microsoft.com/en-us/windows/win32/dataxchg/clipboard-formats https://docs.microsoft.com/en-us/windows/win32/dataxchg/clip... edit2: also some ideas to use the API from autohotkey for concerned people like me: https://www.autohotkey.com/boards/viewtopic.php?t=97251 https://www.autohotkey.com/boards/viewtopic.php?t=97251
- Isthatablackgsd 5y ago> default clipboard manager in windows and 1password - copied passwords do not show up in the clipboard menu Mmm, Windows Clipboard does saves the password that I copied from Keepass, they will be in the menu. However Keepass have a option to clear the last entry in the clipboard which is set for 10 second to let the password persist in the clipboard and then Keepass will overwrite/remove the last entry after the time is up. Very useful imo.
- StingyJelly 5y agoTry it. I was initially worried about this. Turns out with KeePassXC and Klipper it Just Works™ and fields copied (via keyboard shortcut) somehow don't get stored in the clipboard history at all.
- blacksmith_tb 5y agoYes, KeePassXC actually has a little UI element in the lower right of the window that shows when it will clear a copied password out of the clipboard history.
- gefhfffh 5y agoKeePass supports auto type, so you don't really need c&p that often
- austinjp 5y agoAt least one keepass implementation has the option to clear the clipboard after a few seconds. Haven't been at my Windows PC for months, can't remember details. No idea how that would work with clipboard managers, though.
- cornedor 5y agoI'm using Raycast on macOS. When I copy a password using 1Password, the copied text does not end up in Raycast's clipboard history. It might be possible that other password and clipboard managers do the same.
- rerx 5y agoSame experience with Raycast and Enpass. Additionally you can configure apps to be ignored for the clipboard history feature.
- aargh_aargh 5y agoGood point, wondering the same thing. I'm considering starting using a password manager, but my bigest concern is that malware can capture the passwords by listening to clipboard. The model in my head on Windows from programming using WIN32 API two decades ago is that any application can read clipboard contents as often as it wants to. Assuming the malware does that in a tight loop, how can password managers be secure at all? I imagine X Window System is no better in this respect. Has anyone given this any thought? Are my concerns unfounded?
- hunter-gatherer 5y agoThis is still a concern. I do malware analysis for a living and most windows malware these days that steal clipboard data simply hook the windows APIs and grab a copy of everything in there.
- aargh_aargh 5y agoThanks. What would be your recommendation regarding password managers? Does using a password manager's browser extension (assuming it has one) help here or does that also use clipboard? I guess I'm damned either way because I'm gradually migrating to using generated passwords which I copy via clipboard anyway.
- deleted 5y ago[deleted]
- PeterisP 5y agoWouldn't such malware also have the ability to inject itself into the password manager and read the secrets from its memory?
- fsflover 5y agoI solved this problem by using Qubes OS, with isolated VMs for everything and inter-VM secure text copy. The passwords are stored in plain text in an offline VM, no password manager is necessary (but you still can use it if you like).
- 5y ago
- gumby 5y agoI don’t know about windows, but on the Mac you can simply drag the password into the destination field, so no copy/paste required.
- manjana 5y agoIf I'm not wrong you can configure KeepassXC to only store credentials in the clipboard for a selected timespan (like 5, 10 or 30sec). You can also eliminate it entirely IIRC by using the autotype feature when entering credentials.
- GuB-42 5y agoYou can, but AFAIK the way it does that is by overwriting the clipboard with null data. If you have a clipboard manager, it may save your credentials before it is overwritten so that it can retrieved later, and in this case, it is not something you want. Some clipboard managers can be clever and detect a null overwrite and interpret it as a request not to save the overwritten content. Autotype do not suffer this problem and is generally considered safer. Some password managers have an even safer "mixed" mode where part of the password is in the clipboard and another part is auto-typed, meaning you have to monitor both the keyboard and the clipboard to grab the password
- dredmorbius 5y agoAt least one possible fix would be a clipboard management standard such that an application can both set and clear or overwrite a specific clibpoard entry's data. (I'd prefer the clear/overwrite myself.) Another option would be specific IPC such that clipped content is available to one and only one other application or process. There was a recent HN submission on the Unix password manager utility "pass", including the ability to supply passwords to a command via shell expansion rather than as a command-line parameter. The former doesn't reveal the password in either process listings or shell history, the latter does. That's a relatively primitive option, a more robust standard might also be provided.
- ornornor 5y agoI try and copy the password only so that on the very odd chance someone combs through my clipboard history they still wouldn’t know what site or username it matches. I tend to use unique/generated usernames or emails as much as I can so that I’m not “1337wiz” on every website I have an account on.
- kayodelycaon 5y agoBlacklisting BitWarden in the clipboard manager. If I copied from another app, it's four extra keystrokes to paste and delete: Cmd+V -> Cmd+Shift+V -> Cmd+Delete -> Esc.
- avgcorrection 5y agoMy clipboard manager does not store things copied from KeepassX. Based on what the window is called. I had to configure it. CopyQ.