76

Via Hacker News, I came across a Tweet implying that Facebook's iOS app routinely reads and transmits all content from the user's pasteboard.

Leaving aside whether Facebook's app genuinely does this (which is a separate question), is this possible? I had always naively assumed that an app couldn't access what was on my clipboard unless I explicitly chose to "Paste" into a native text view. Is that assumption wrong? What is the security model for the content of the clipboard on the two major phone OSes? (Or what are the security models, if it's handled differently between iOS and Android?)

  • 16
    This is true for not just mobile devices, but also desktop OSes. For example, Windows has an event, WM_CLIPBOARDUPDATE, that any application can register for. As far as I can tell, most OSes are not designed to protect the clipboard from casual monitoring. – phyrfox Dec 30 '17 at 15:47
  • 3
    For that matter, can any open website read my clipboard? – Eric Duminil Jan 1 '18 at 0:15
  • 2
    @EricDuminil Did a quick search, and it looks like IE can request clipboard contents with a popup for user's permission. It also appears that old versions of flash could read clipboard contents, but that has since been fixed/removed – phflack Jan 1 '18 at 5:53
  • 2
    @EricDuminil The web browser can read your clipboard (obviously), but the web site cannot. However, web extensions may be able to, so you should always take care to make sure your installed extensions are not spying on you. – phyrfox Jan 1 '18 at 9:02
  • 4
    This is why I prefer using password managers that don't copy text to the clipboard, but rather use a separate keyboard with access to my credentials. – Peter Majeed Jan 1 '18 at 15:57
82

Android

Yes, it's possible in Android. Any app/service can read your clipboard data. In fact, there is a lot of code online which creates a service running with a listener in the background, which will inform the app whenever the content on the clipboard changes, along with the content.

There are a few Android apps that I know which use this feature. One is Truecaller: whenever a contact number is copied, an on-screen overlay tells me the phone number's owner's name. Another one is Google Translate: whenever I copy a statement or two, I see a floating icon on my screen, which, upon clicking, gives me an option to translate the copied text to another language.

Here is an example from Stack Overflow for your reference.

iOS

As confirmed in the comments by user 11684, even Apple allows apps to read your clipboard (though only while they are in the foreground). Here is the link to the documentation that returns the data of the clipboard.

  • 6
    Worth noting that this does not require any permission to be granted - any app can do this. There's a very good writeup about the issue here: github.com/grepx/android-clipboard-security – JonasCz Dec 31 '17 at 6:37
  • Do they have access to all my clipboard history or just the current clipboard entry and is this true for screenshots in the clipboard? Can they read my screenshots in my clipboard? – Skiddie Hunter Jan 10 at 10:42
6

It is definitely possible for an app to check the clipboard content anytime.

Example: copy a link, then open Chrome. It will offer the link in the search bar (‘goto link you copied’). If you copy something that is not a link, it will not make that offer. This proves that it checks the clipboard without explicit user action.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.