Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can a browser get the data on my clipboard? Data could be for example my temporary password?

Any browser or operating system that allows this?

share|improve this question

5 Answers 5

up vote 8 down vote accepted

Note that other client side technologies such as Java applet, Adobe Flash, Silverlight may also have access to your data in the clipboard.

share|improve this answer

For Javascript, Internet Explorer allows you to block that specific functionality, without disabling Javascript altogether.
In Tools -> Internet Options -> Security -> -> Custom Level, you can find the following setting:

IE Security Settings

Sadly, I wasn't able to find an equivalent setting in neither FF nor in GChrome.

Additionally, however, as it has been mentioned, there are other ways besides Javascript for a browser/webapp to access your clipboard. Some have some forms of controls available too, but I'm not familiar with all of them (e.g. Silverlight has CAS, but I dont know SL well enough to know how to block it).

share|improve this answer
    
This is very nice to know... also i like your paint circle. –  Ormis Apr 8 '11 at 19:30
    
@Ormis, thanks - apparently it's called a Freehand Circle :) –  AviD Apr 9 '11 at 19:37

On Windows, any process (running on the same desktop, IIRC) can monitor changes to the clipboard with the SetClipboardViewer API call.

PasswordSafe, a well known password management tool, allows you to drag and drop the password onto a web page, bypassing the clipboard altogether.

share|improve this answer
2  
Also, even if you do copy the password to the clipboard, PasswordSafe ensure removing it from memory after a short time, e.g. when it gets minimized. –  AviD Apr 8 '11 at 8:57

The simple answer Yes. But this is usually done through Javascript, maybe some other ways as well. But if you disable Javascript it will help you with your concerns for security. I'd suggest you read this.

share|improve this answer
    
then why isn't <a href="chrome.google.com/extensions/detail/…; & <a href="addons.mozilla.org/en-US/firefox/addon/noscript/…; installed by default or maintained by google & mozilla? we need bigger security!! :P :) –  LanceBaynes Mar 22 '11 at 8:04
    
@johnny8888 - because a lot of users would complain that it broke website 'x'. Google, Mozilla and others are trying to push for greater acceptance but it also requires web app developers to develop their code to not rely on insecure mechanisms. It's a slow process:-) –  Rory Alsop Mar 22 '11 at 8:56
    
@Rory - I agree and this is very true. If you started eliminating a lot of Java and other 3rd party coding in web browsers you'll find a lot of websites will look like crap/not run properly. –  Split71 Mar 22 '11 at 13:48

Clipboard is not secure, especially if you use IE browser as it allows certain function that allows a malicious page to run a javascript that can read your stored clipboard data and then submit a form with that data... Or write junk data and overwrite anything (important) you had.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.