49

I've been using the Windows clipboard as a method of getting passwords from Lastpass into desktop applications.

I've been wondering exactly how secure is this? Can't any program access the clipboard at any time?

  • 1
    I remember that clipboard access was enabled by default in some (old) versions of IE (probably IE6). I have found this link where MS put a warning window each time a website tried to access your clipboard, but it looks that it wasn't there earlier. So if you use IE <=6 (you don't, right?) you may be at extra risk. – Carlos Campderrós Jul 6 '15 at 15:55
  • 3
    Running the clipboard on an old shared VMWare Player in an office setting reveals many interesting things about your coworkers. I always had to be careful when responding to people at my old job because there was a good chance if I cut and pasted it would wind up in the boss's clipboard. – Peter Turner Jul 6 '15 at 19:21
  • 1
    @CarlosCampderrós I think flash still allows that. – CodesInChaos Jul 7 '15 at 6:52
  • 2
    KeePass has an option in "Memory" settings: "CLipboard behaviour: Enhanced: allow pasting once and protect against clipboard spies" – DBedrenko Jul 7 '15 at 9:12
59

It is not secure.

See this question & answer on Security.stackechange.com, quoted below:

The Windows clipboard is not secure.

This is a quote from a MSDN article.

The Clipboard can be used to store data, such as text and images. Because the Clipboard is shared by all active processes, it can be used to transfer data between them.

This should probably apply to Linux machines as well.

Is this a concern? No. For someone to exploit this, he would have to have malware on your machine capable of reading data from the clipboard. If he has the capability of getting malware on your machine, you have much bigger things to worry about as there are plenty of other stuff he can do, including keyloggers and the like.

  • 4
    While it is trivial to read the data in the clipboard, as Keltari explains, the fact you have malicious software reading you clipboard in the first place is your larger concern. This is the reason copying and pasting your password into a password field has not effect on keeping your password secure, the ability to do so, is convincence.of not typing a 20-30 character secure random password. – Ramhound Jul 6 '15 at 10:40
  • 2
    Of course the threshold is much lower for malware that reads the clipboard (an entirely "legal" piece of javascript embedded in a web page will do) versus malware that exploits the browser process or reads another process' memory, or installs a hook to capture keypresses, etc. – Damon Jul 6 '15 at 13:44
  • 24
    @Damon From what I understand, JS doesn't have random access to the clipboard for precisely this reason. – Colonel Thirty Two Jul 6 '15 at 14:04
  • 3
    @Damon According to MDN, the app needs to have permission to use the paste command, so random pages can't sniff your clipboard using that. – Colonel Thirty Two Jul 6 '15 at 14:14
  • 2
    @zzzzBov - And what would stop someone from adding a button in Javascript titled "Free Money - Click Here!", but the button actually copies your clipboard instead of giving you money for free? – Yay295 Jul 7 '15 at 3:27
6

Just bear in mind that it's not only the applications that may have access to the clipboard and it's not only malware that actually might want to get it.

There are also users that may accidentally or on purpose reveal the content of the clipboard after getting physical access to the computer. Of course, then they can do a lot of harm anyway, but getting the actual password (and not just access to websites/programs) is hard (unless you have it in the clipboard...)

So either make sure the clipboard is cleaned (and this is not 100% reliable as some applications again allow to retrieve old clipboard values) or use some kind of encryption (this is not trivial, but even easy one will protect from accidental password leak)

  • 1
    Encryption isn't going to help for this. The attack isn't against the memory the clipboard (or clipboard history) is stored in. The attack is retrieving the clipboard contents using the standard clipboard API (either a running program reading it, or another user gaining temporary access and initiating a paste). – Peter Cordes Jul 7 '15 at 2:47
  • 1
    Not exactly Peter, we do not know the architecture of the original solution, but if your application at first put the content in the clipboard and then retrieves it it can modify the data in a way that it is only understandable to itself. So when someone or even you with someone looking accidentally reveals the content it is not yet obvious what was inside and how to use it. Any way revealing a plain text password is to my mind the highest security breach possible. I'd honestly never consider copying it to the clipboard or text file, etx. There are better ways of communication between apps :) – mikus Jul 7 '15 at 7:53
  • 3
    @mikus while true, this is not usually the way the clipboard works. The clipboard is really only useful to share content from one app to another. A single app may as well just store the encrypted contents in memory for later retrieval and avoid the clipboard altogether. – trlkly Jul 7 '15 at 8:39
  • Indeed, I have never said otherwise, but as long as I dont think any commercial application like LastPass leaves anything in clipboard I guess the author has control over both of the applications. Then he can choose whatever encoding or encryption he wants, right? and other communication methods as well :) If its lastpass saving plaintext passwords in clipboard, then its just not right application to use IMO. – mikus Jul 8 '15 at 8:48
2

As everyone agrees, the clipboard is generally insecure. Thus, the followup question is obvious: how to get complex passwords/passphrases from a password manager into where they're needed, without exposing them along the way.

Look for a password manager that has an option to "type your password into the next window you click on" or similar. I don't know of any examples, because I'm not that paranoid about most passwords. (And I actually memorize the very few high-security passwords I use, like my GPG private key.)

Community wiki: edit in names of programs that have this feature:

  • KeePassX

My version of KeepassX, 0.4.3, offers clearing the clipboard after X seconds (defaults to 20 but 8 is fine)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.