I've been using the Windows clipboard as a method of getting passwords from Lastpass into desktop applications.
I've been wondering exactly how secure is this? Can't any program access the clipboard at any time?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
It is not secure.
See this question & answer on Security.stackechange.com, quoted below:
The Windows clipboard is not secure.
This is a quote from a MSDN article.
The Clipboard can be used to store data, such as text and images. Because the Clipboard is shared by all active processes, it can be used to transfer data between them.
This should probably apply to Linux machines as well.
Is this a concern? No. For someone to exploit this, he would have to have malware on your machine capable of reading data from the clipboard. If he has the capability of getting malware on your machine, you have much bigger things to worry about as there are plenty of other stuff he can do, including keyloggers and the like.
Just bear in mind that it's not only the applications that may have access to the clipboard and it's not only malware that actually might want to get it.
There are also users that may accidentally or on purpose reveal the content of the clipboard after getting physical access to the computer. Of course, then they can do a lot of harm anyway, but getting the actual password (and not just access to websites/programs) is hard (unless you have it in the clipboard...)
So either make sure the clipboard is cleaned (and this is not 100% reliable as some applications again allow to retrieve old clipboard values) or use some kind of encryption (this is not trivial, but even easy one will protect from accidental password leak)
As everyone agrees, the clipboard is generally insecure. Thus, the followup question is obvious: how to get complex passwords/passphrases from a password manager into where they're needed, without exposing them along the way.
Look for a password manager that has an option to "type your password into the next window you click on" or similar. I don't know of any examples, because I'm not that paranoid about most passwords. (And I actually memorize the very few high-security passwords I use, like my GPG private key.)
Community wiki: edit in names of programs that have this feature:
My version of KeepassX, 0.4.3, offers clearing the clipboard after X seconds (defaults to 20 but 8 is fine)