I noticed that multiple password-locker applications recommend that you use the drag-and-drop feature to transfer passwords to login forms instead of copying the passwords to the clipboard or having the password locker type the password for you using simulated key presses. The basic argument its fairly easy for a keylogger to record key presses or to peek inside the contents of the clipboard.

I know that nothing can totally protect your data if your computer has been compromised but is it true that its harder for spyware to get the password if its transferred using drag-and-drop?

  • Any program capable of logging keystrokes is capable of filming the screen, taking screenshots, unmasking the "****" hidden passwords, reading all your personal files and uploading all that to the attacker. I think all these precautions are snake oil and waste of time. If your machine is compromised, it's compromised and your only option is to reinstall from backups and repair eventual damage (that's why 2FA is good because it can prevent damage to your other accounts even if your entire password manager is pwned).
    – user42178
    May 12 '15 at 10:56

Though it's better in the sense that communication is automatically between two windows (and you can hope the object disappears after it's transferred), I'm voting no¹ because:

The only protection I saw was at the process level: you can't DnD from a non-elevated process to an elevated one (prevents shatter attacks).

¹ I don't have a Windows system to test on so I'm just referencing things that seem to disprove it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.