Don't disable the clipboard on sensitive data

muellerberndt / android_app_security_checklist

Android App Security Checklist

852 stars 202 forks source link

Don't disable the clipboard on sensitive data #2

Closed rugk closed 2 years ago

rugk commented 6 years ago

The clipboard is deactivated on text fields that may contain sensitive data.

No, please don't. That prevents many password managers from working (not all of them support Android 8's new APIs). So if the result is users use 12345 as a password (with the result that everyone can login) instead of a good password copied and saved from their password manager (with the potential that other apps may access it), then you've done more harm than good.

muellerberndt commented 6 years ago

Hi @rugk, definitely a valid point. This list reflects the OWASP MASVS, so I suggest you take the discussion on the MASVS repo!