Hacker News Reader

Comment by jononor | Hacker News Reader

Hm. What mechanism does password managers like Onepass and Lastpass use?

I only use KeepAss, but it provides it's own keyboard so that when you have an entry selected in the app you can press the "user" and "password" keyboard buttons without copying.

I assume (hope) the others do it the same way. Clipboard memory has _never_ been safe not on PC and not on phones.

Which app do you use? I'm using KeePassDroid, which seems to be the most popular, and as far as I can tell it only supports the clipboard method.

I'm not the person you replied to, but Keepass2Android [0] has the custom keyboard for password entry.

[0]. https://play.google.com/store/apps/details?id=keepass2androi...

Sorry for the late reply, but I use this too (I wrote the original keepass post)

I use KeepShare, which has a custom keyboard for password entry, but also uses the accessibility APIs to auto-fill.

Could you explain why you say that about the PC? As far as I know, the browser isn't going to let someone snatch your clipboard info. An application running locally, sure, but an application running locally could also be doing keylogging, I'd think.

It is probably better now, but you used to be able to copy clipboard content from javascript or flash.

Keepass for windows and linux use autotyping or clears the buffer after a few seconds if you copy.

Oh, I see. Yeah, Flash is a different story, I guess, but for JavaScript you can't get at the clipboard unless someone pastes in all the browsers I'm aware of.

There's a library for accessing the clipboard within JS[1]. As far as I can tell, the HTML5 APIs for it are designed to stop this from being used to steal your clipboard but I somewhat doubt its effectiveness.

[1]: https://clipboardjs.com/

That seems to let you write to the clipboard, not read it.

The API used (document.execCommand) supports "paste" which lets you paste the current contents of the clipboard. However, it doesn't appear to work in my version of Chromium.

The same argument is true on smartphones. Only an application you've installed is able to snatch your clipboard info.

Treat your phone like you've always treated your desktop - only install trusted applications and use tools like XPrivacy to analyze sketchy applications and block "features" for the ones you absolutely need to use.

LastPass either hooks up to the Accessibility framework (scanning for password fields and filling them in directly), provides a keyboard (filling directly) or standard copy/paste.

AFAIK, LastPass still uses clipboard, even when accessibility APIs are available. Probably because new-style autofills (like pass implementation Password Store uses) are possible since relatively recent API revisions and there are still a lot of 4.x Androids out there.

Maybe I'm wrong, but at the very least, XPrivacy indicates it accesses clipboard shortly after requesting auto-fill - don't have a hook for setting text there.

As far as I can tell LastPass also clears the clipboard after you've pasted a password or something from the app. The other day I had to paste my Google password twice and noticed that it was cleared from the clipboard in the meantime.

Reply on news.ycombinator.com