search

albertlauncher / albert

A fast and flexible keyboard launcher
https://albertlauncher.github.io
Other
7.29k stars 307 forks source link

[clipboard] protect sensitive clipboard entries (passwords) #1449

Open martinengelke opened 1 month ago

martinengelke commented 1 month ago

Package source

GitHub

App logs

macOS

Current Behavior

Passwords are going right into the clipboard. I am not sure how to change that, since I tried it as well with Maccy.app and it also saved my PayPal password which is maybe not supposed like that?:

Maccy Website: Maccy respects your privacy. If your password manager removes a copied password from the clipboard, so will Maccy. Everything is stored on your computer.

Expected Behavior

Maybe the Password could not saved in clear form but instead with ****? Any further suggestions?

Anything else?

No response

martinengelke commented 1 month ago

Raycast Clipboard Manager says:

Copied content never leaves your computer and is encrypted on your local hard drive. Passwords copied from any password managers and other transient data are ignored by default, ensuring your sensitive information remains secure.

ManuelSchneid3r commented 1 month ago

Which passwords? How can Albert know if the text copied is a password?

martinengelke commented 1 month ago

As you read above, others suggest that there is some way. I don't know exactly without taking a deeper dive into google. Since there are special input forms: Password: ** They should be somehow recognised (have a certain flag, the clipboard can read out?).

If I find some time I will look for it.

ManuelSchneid3r commented 1 month ago

Probably guys at Raycast tell you so because alleged security sells. In fact the clipboard is public. a malicious software needs way less of an effort to get your copied passwords than finding files that somewhere bury this information. not in Wayland though where desktop security really is a thing.

martinengelke commented 1 month ago

http://nspasteboard.org

Maccy Settings:

Bildschirmfoto 2024-10-17 um 14 42 22
ManuelSchneid3r commented 1 month ago

So you care about them not being visible on your screen? Because if I got it right this mechanism only protects against “shoulder surfers”. the data is still plain text.

ManuelSchneid3r commented 1 month ago

Dont get me wrong i like the idea. But we should do it right to not fool our users.

martinengelke commented 1 month ago

This is why I am here, on the Light Side. image

Perhaps we can find a better approach, but this seems rather difficult.