Hacker News Reader

Comment by tyfon | Hacker News Reader

I only use KeepAss, but it provides it's own keyboard so that when you have an entry selected in the app you can press the "user" and "password" keyboard buttons without copying.

I assume (hope) the others do it the same way. Clipboard memory has _never_ been safe not on PC and not on phones.

View on HN

Which app do you use? I'm using KeePassDroid, which seems to be the most popular, and as far as I can tell it only supports the clipboard method.

I'm not the person you replied to, but Keepass2Android [0] has the custom keyboard for password entry.

[0]. https://play.google.com/store/apps/details?id=keepass2androi...

Sorry for the late reply, but I use this too (I wrote the original keepass post)

I use KeepShare, which has a custom keyboard for password entry, but also uses the accessibility APIs to auto-fill.

Could you explain why you say that about the PC? As far as I know, the browser isn't going to let someone snatch your clipboard info. An application running locally, sure, but an application running locally could also be doing keylogging, I'd think.

The same argument is true on smartphones. Only an application you've installed is able to snatch your clipboard info.

Treat your phone like you've always treated your desktop - only install trusted applications and use tools like XPrivacy to analyze sketchy applications and block "features" for the ones you absolutely need to use.

It is probably better now, but you used to be able to copy clipboard content from javascript or flash.

Keepass for windows and linux use autotyping or clears the buffer after a few seconds if you copy.

Oh, I see. Yeah, Flash is a different story, I guess, but for JavaScript you can't get at the clipboard unless someone pastes in all the browsers I'm aware of.

There's a library for accessing the clipboard within JS[1]. As far as I can tell, the HTML5 APIs for it are designed to stop this from being used to steal your clipboard but I somewhat doubt its effectiveness.

[1]: https://clipboardjs.com/

That seems to let you write to the clipboard, not read it.

The API used (document.execCommand) supports "paste" which lets you paste the current contents of the clipboard. However, it doesn't appear to work in my version of Chromium.

Reply on news.ycombinator.com