14

Can a browser get the data on my clipboard? Data could be for example my temporary password?

Any browser or operating system that allows this?

Improve this question

5 Answers 5

Reset to default
9

Note that other client side technologies such as Java applet, Adobe Flash, Silverlight may also have access to your data in the clipboard.

Improve this answer
11

For Javascript, Internet Explorer allows you to block that specific functionality, without disabling Javascript altogether.
In Tools -> Internet Options -> Security -> -> Custom Level, you can find the following setting:

IE Security Settings

Sadly, I wasn't able to find an equivalent setting in neither FF nor in GChrome.

Additionally, however, as it has been mentioned, there are other ways besides Javascript for a browser/webapp to access your clipboard. Some have some forms of controls available too, but I'm not familiar with all of them (e.g. Silverlight has CAS, but I dont know SL well enough to know how to block it).

Improve this answer
0
4

On Windows, any process (running on the same desktop, IIRC) can monitor changes to the clipboard with the SetClipboardViewer API call.

PasswordSafe, a well known password management tool, allows you to drag and drop the password onto a web page, bypassing the clipboard altogether.

Improve this answer
2
  • 2
    Also, even if you do copy the password to the clipboard, PasswordSafe ensure removing it from memory after a short time, e.g. when it gets minimized.
    – AviD ♦
    Apr 8, 2011 at 8:57
  • Any information on how they do this?
    – OrigamiEye
    Nov 21, 2019 at 10:03
3

The simple answer Yes. But this is usually done through Javascript, maybe some other ways as well. But if you disable Javascript it will help you with your concerns for security. I'd suggest you read this.

Improve this answer
4
  • then why isn't <a href="chrome.google.com/extensions/detail/…> & <a href="addons.mozilla.org/en-US/firefox/addon/noscript/…> installed by default or maintained by google & mozilla? we need bigger security!! :P :)
    – LanceBaynes
    Mar 22, 2011 at 8:04
  • @johnny8888 - because a lot of users would complain that it broke website 'x'. Google, Mozilla and others are trying to push for greater acceptance but it also requires web app developers to develop their code to not rely on insecure mechanisms. It's a slow process:-)
    – Rory Alsop ♦
    Mar 22, 2011 at 8:56
  • @Rory - I agree and this is very true. If you started eliminating a lot of Java and other 3rd party coding in web browsers you'll find a lot of websites will look like crap/not run properly.
    – Split71
    Mar 22, 2011 at 13:48
  • @LanceBaynes I think that when you copy-pasted the link broke. It is for NoScript, yes? NoScript is awesome.
    – MikeP
    Oct 18, 2016 at 15:59
0

Clipboard is not secure, especially if you use IE browser as it allows certain function that allows a malicious page to run a javascript that can read your stored clipboard data and then submit a form with that data... Or write junk data and overwrite anything (important) you had.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .