News for hackers. Stuff that matters.

A comment on Android permissions and hypocrisy. Parent comment

Re:Android permissions and hypocrisy by tyfon on Monday January 23, 2017 @05:55AM (#13461293)
I only use KeepAss, but it provides it's own keyboard so that when you have an entry selected in the app you can press the "user" and "password" keyboard buttons without copying.

I assume (hope) the others do it the same way. Clipboard memory has _never_ been safe not on PC and not on phones.

[ Parent | on HN ]
Re:Android permissions and hypocrisy by pdw on Monday January 23, 2017 @07:13AM (#13461606)
Which app do you use? I'm using KeePassDroid, which seems to be the most popular, and as far as I can tell it only supports the clipboard method.
[ Parent | on HN ]
Re:Android permissions and hypocrisy by kenny_r on Monday January 23, 2017 @07:28AM (#13461713)
I'm not the person you replied to, but Keepass2Android [0] has the custom keyboard for password entry.

[0]. https://play.google.com/store/apps/details?id=keepass2androi...

[ Parent | on HN ]
Re:Android permissions and hypocrisy by tyfon on Monday January 23, 2017 @07:33AM (#13461747)
Sorry for the late reply, but I use this too (I wrote the original keepass post)
[ Parent | on HN ]
Re:Android permissions and hypocrisy by Nullabillity on Monday January 23, 2017 @07:29AM (#13461719)
I use KeepShare, which has a custom keyboard for password entry, but also uses the accessibility APIs to auto-fill.
[ Parent | on HN ]
Re:Android permissions and hypocrisy by emodendroket on Monday January 23, 2017 @07:30AM (#13461730)
Could you explain why you say that about the PC? As far as I know, the browser isn't going to let someone snatch your clipboard info. An application running locally, sure, but an application running locally could also be doing keylogging, I'd think.
[ Parent | on HN ]
Re:Android permissions and hypocrisy by problems on Monday January 23, 2017 @09:45AM (#13462459)
The same argument is true on smartphones. Only an application you've installed is able to snatch your clipboard info.

Treat your phone like you've always treated your desktop - only install trusted applications and use tools like XPrivacy to analyze sketchy applications and block "features" for the ones you absolutely need to use.

[ Parent | on HN ]
Re:Android permissions and hypocrisy by tyfon on Monday January 23, 2017 @07:42AM (#13461775)
It is probably better now, but you used to be able to copy clipboard content from javascript or flash.

Keepass for windows and linux use autotyping or clears the buffer after a few seconds if you copy.

[ Parent | on HN ]
Re:Android permissions and hypocrisy by emodendroket on Monday January 23, 2017 @08:57AM (#13462152)
Oh, I see. Yeah, Flash is a different story, I guess, but for JavaScript you can't get at the clipboard unless someone pastes in all the browsers I'm aware of.
[ Parent | on HN ]
Re:Android permissions and hypocrisy by cyphar on Monday January 23, 2017 @10:59AM (#13463050)
There's a library for accessing the clipboard within JS[1]. As far as I can tell, the HTML5 APIs for it are designed to stop this from being used to steal your clipboard but I somewhat doubt its effectiveness.

[1]: https://clipboardjs.com/

[ Parent | on HN ]
Re:Android permissions and hypocrisy by emodendroket on Monday January 23, 2017 @11:39AM (#13463430)
That seems to let you write to the clipboard, not read it.
[ Parent | on HN ]
Re:Android permissions and hypocrisy by cyphar on Monday January 23, 2017 @12:00PM (#13463610)
The API used (document.execCommand) supports "paste" which lets you paste the current contents of the clipboard. However, it doesn't appear to work in my version of Chromium.
[ Parent | on HN ]