1

Let's say I'm working in application A and copy some sensitive data to clipboard. Can application B which is opened at the moment catch the information I've copied?

Does OS X protect from such vulnerabilities?

Update: To be more specific what if I copy a password from a password manager, is the pass accessible for all the apps while it is in clipboard? If so how password managers protect a user in this case?

9
  • Protect from what? Using the clipboard to paste a password into an login page is standard behavior of typical password managers.
    – nohillside
    Jan 28 '18 at 19:37
  • Each password manager is different but the best ones (i.e. 1Password) have a setting allows you to set the amount of time a password will be available on the system's clipboard. After that amount of time, the application will overwrite the clipboard, thus erasing the password that was there.
    – fsb
    Jan 28 '18 at 19:41
  • @patrix I meant is it possible that third app will somehow steal the password during the short time between the moment when a user copied it and the moment when he pasted and cleared the buffer. Jan 28 '18 at 19:43
  • @fsb so do the other managers. But theoretically is that possible that during the 10 seconds interval while the pass is in clipboard another app steals it? Jan 28 '18 at 19:45
  • 1
    Yes. Theoretically and practically.
    – nohillside
    Jan 28 '18 at 19:52
3

This is not a vulnerability per se.

The clipboard is accessible system wide which is why you can copy something from application A and paste it to application B.

It's not meant nor does it function as a secure holing area.

If an application has sensitive data fields, it is up to the developers to block clipboard access to the data. For all intents and purposes, once info is in the clipboard, it's accessible.

As a test and demo, copy your password from your password manager. Open terminal and type the command pbpaste. It will output the password that's residing in your clipboard.

1
  • If it's in the clipboard, it's accessible.
    – Allan
    Jan 28 '18 at 19:52
1

It's probably worth stating that having any app on your system which you do not trust is not advisable.

As others have already mentioned (and this post is old, so this benefits only those who stumble upon it later), there are ways in some password managers (I'm familiar with 1Password, personally) that can remove that item from your clipboard after a predetermined period of time. However, beyond that concern, I would seriously question the idea of running an app for which you do not have a certain level of trust. If you have any doubts, that's the first thing I'd resolve.

1

Not the answer you're looking for? Browse other questions tagged .