45

I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times.

In what scenarios this could be a bad idea?

46

The Windows clipboard is not secure.

This is a quote from a MSDN article.

The Clipboard can be used to store data, such as text and images. Because the Clipboard is shared by all active processes, it can be used to transfer data between them.

This should probably apply to Linux machines as well.

Is this a concern? No. For someone to exploit this, he would have to have malware on your machine capable of reading data from the clipboard. If he has the capability of getting malware on your machine, you have much bigger things to worry about as there are plenty of other stuff he can do, including keyloggers and the like.

  • 3
    Note that several (all?) password managers use the clipboard for password entry. While one has to be careful with arguments to popularity or to absence of harmful effects, we aren't seeing floods of compromises that are specific to password managers and clipboard usage. – Jonathan Garber Mar 30 '13 at 2:39
  • 4
    @JonathanGarber From the KeePass site - Timed clipboard clearing: KeePass can clear the clipboard automatically some time after you've copied one of your passwords into it. Like I said though, if you can't trust your computer, you are basically screwed. – user10211 Mar 30 '13 at 2:44
  • 13
    Keyloggers usually would require admin privilege, but you don't usually need any special privileges to read the clipboard. – Lie Ryan Aug 20 '14 at 14:42
  • 1
    As a general recommendation, once you paste a password, copy something else immediately to reset it. Leaving your password on memory for a long time, increases the chances of being compromised. For example: You could accidentally paste your password into an input field in a website (like search). Once pasted, sites could easily have access to it intentionally or unintentionally posing a security risk. – lepe Aug 31 '15 at 7:10
  • 2
    @Jonathan Garber: Not all - some of them emulate keystrokes, and in this mode the password does not touch the clipboard at all. – Piskvor Aug 31 '15 at 9:24
7

Aside from the clipboard contents being available for snooping, there have been exploits where web pages can grab your clipboard data, and one where web ads written in Flash (this was before version 10) could stuff malware URLs onto your clipboard, in hopes that unsuspecting users would paste them into e-mail, blogs, etc., without noticing what they contained. Since my clipboard extender (ClipMate) acted as an early-warning to the malicious activity, my blog post was cited quite a bit.
http://www.clipboardextender.com/defective-apps/clipboard-virus-not-exactly-but-still-dangerous

4

This is insecure; as the MSDN article notes, the data can be read by other users (and by unprivileged users). Someone who could not necessarily install other malware could still read the clipboard data.

When it would be a "bad idea" depends on what might be running on the system, how sensitive the password is, etc.

  • 1
    No, other unprivileged users can't get the content of the clipboard: the clipboard is specific to a session. It doesn't make it secure from applications running in the same user context, though. – Stephane Feb 10 '15 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.