qutterr / keepassdroid

Automatically exported from code.google.com/p/keepassdroid
0 stars 0 forks source link

Clipboard can expose passwords to other apps. Fix thru accessibility? #713

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago

What steps will reproduce the problem?
1.   Issue 653 is a simpler statement of issue
2.Paper at 
https://www.researchgate.net/publication/236014197_Hey_You_Get_Off_of_My_Clipboa
rd_-_On_How_Usability_Trumps_Security_in_Android_Password_Managers

3.

What is the expected output? What do you see instead?

From info on https://www2.dcsec.uni-hannover.de/files/p170.pdf  
1 other apps can monitor changes in clipboard
2 other apps can read clipboard data
3 thus  'copy and paste'  while convenient, risks exposure of passwords through 
malware apps.

What version of the product are you using? On what operating system?
Any

Apparently Lastpass uses accessibility features to get around this. 

Original issue reported on code.google.com by PeterLie...@gmail.com on 19 Jul 2014 at 1:35

GoogleCodeExporter commented 8 years ago
From google search (cache) I can find phrase:
"KeePassDroid is an implementation of the KeePass Password Safe for Android. 
... Integrated Soft-Keyboard: Switch to this keyboard for entering user 
credentials ..."

From URL: 
https://www.google.fi/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ve
d=0CCAQFjAA&url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dco
m.android.keepass%26hl%3Den&ei=Q1zrU7uMBeuV0QXev4CYCw&usg=AFQjCNFg2woaiPL0IMIsJ7
PeQVz9yjBtcw&sig2=jvzCnGZjWIrE-Ut7n4Z8rQ&bvm=bv.72938740,d.d2k

However, can't see that on the page nor can't find that from app's settings or 
changelog.

Original comment by osmo.lai...@gmail.com on 13 Aug 2014 at 12:42

GoogleCodeExporter commented 8 years ago
Just FYI this is actually a dupliacte of issue 653.

Original comment by vphan...@gmail.com on 23 Nov 2014 at 6:36

GoogleCodeExporter commented 8 years ago
Keepass2Android avoids this issue.
https://play.google.com/store/apps/details?id=keepass2android.keepass2android&hl
=en

Original comment by PeterLie...@gmail.com on 23 Nov 2014 at 8:27