clipto-pro / Android

Cross-platform Universal Clipboard & Notes
https://play.google.com/store/apps/details?id=com.wb.clipboard.pro
160 stars 11 forks source link

Security: delete last clipboard item after few seconds #33

Open 5TDg9 opened 4 years ago

5TDg9 commented 4 years ago

Enhancement suggestion:

  1. There should be an option to clear the last clipboard item after some time.
  2. It should be possible to choose this time between 10 and 30 seconds (or more)

Since Android 10 there is a big improvement concerning clipboard data privacy. Only the app that currently has focus (or an input method editor) is able to access clipboard data: https://developer.android.com/about/versions/10/privacy/changes#clipboard-data

Before Android <10 the problem was much bigger: https://github.com/grepx/android-clipboard-security

Unfortunately still a lot of people use older android versions and the security problem (if someone puts sensitive infomation like passwords into clipboard) even with android 10 is not gone completely (and problably will never be ever).

Possible solution: I think clipboard-data in android (and most operating systems) is always just ONE database record. So the clipboard "history" must be in Clipto's app database except the last / current data record. In the settings area you could offer an option to activate erase of clipboard for example after 10 or 30 seconds. If this option is activated the user has limited time to do whatever they want (edit, create tags, etc) before the following happens:

  1. The current clipboard data is copied/saved to Clipto's internal database (which is already or could be encrypted aswell) and
  2. The current clipboard record is cleared or made illegible with ***

After the given time (for example 30 seconds) another (malicious) app would not be able to access the sensitive clipboard data anymore BUT also the data would be still available for the user within Clipto to use it later again if necessary (and delete it manually later).

atrashler commented 4 years ago

Need to think how it could be done in a more secured way. Possibly it could be done with a different flow: 1) user copies any text 2) Clipto monitors this change, take a note from it and clear the clipboard 3) Once the user wants to use this clip to paste somewhere else, he put a focus into a field and Clipto suggest him recent clips to be used.

gggirlgeek commented 3 years ago

+1 for this. I know Lastpass has the option to clear the clipboard after a few seconds. So you could implement a timer that only copies the note into Clipto after that set time, so when Lastpass deletes it, it never gets copied into Clipto.