(Emphasis mine.)
Well. The moment you have evil code running on your box, as you, then I'll naively assume you have a bigger problem to deal with anyway.
> The clipboard is a big public billboard visible to anything running on your computer.
And everything from client work to love letters in my home folder is available to anything that runs as me, unless I've gone out of our way to secure it - and succeed.
Not saying the clipboard isn't a problem.
Not saying browsers shouldn't expose a carefully thought out API.
But the way I read your post it might scare people away from password managers and back to a single password or passwords written on papers stored within reach from the workplace.
So is your keyboard buffer. If someone's already in your computer watching your clipboard they're probably also watching anything you type too
Eventually everyone should be using https://github.com/flatpak/xdg-desktop-portal/blob/master/da... (which is based on https://pipewire.org )
For now, e.g. https://github.com/fzwoch/obs-gnome-screencast uses org.gnome.Shell.Screencast
The fact that password managers use it at all is simply because it is the only hack that works to reliably get data into password boxes. Yes, its a hack. The HTML5 spec should have exposed a mechanism to securely insert data into an element tagged for such a purpose. A one way mechanism.