Clipboard Sniffing?

M113E55ML

Is there something like clipboard sniffing on grapheneos or android in general?
lets say i copy a password from my password manager, or any other text from whatsapp, signal or reddit, are other apps able to read the clipboard? and if yes, is it somehow possible to E2EE the clipboarD?

Dumdum

M113E55ML
The currently focused app can, as far as I'm aware.

Relevant issue for clipboard access:
https://github.com/GrapheneOS/os-issue-tracker/issues/2917

Quantum

M113E55ML I think FlorisBoard keyboard has an internal clipboard which might help prevent it from "leaking".

Edit: The latest clipboard item might still be in focus though. You'll maybe need to read FlorisBoard documentation about that.

M113E55ML

Dumdum

Quantum

Thank you, I am currently using FUTO Keyboard, does it work similiar to Florisboard regarding internal clipboard?

Quantum

M113E55ML Got no clue as I'm using FlorisBoard. Maybe the github page for Futo will have some documentation?

M113E55ML

Quantum

I tested both and Futo keyboard failed to keep the copied text internally. I copied a text inside the main profile and pasted it in a app inside the work profile and it pasted. With Florisboard it kept the copied text internaly. Thank you guys, you helped me! This is what I needed

Quantum

M113E55ML Just make sure that certain settings for FlorisBoard is correct. Otherwise it might use both.

I did some testing:
Use internal clipboard needs to be active.
For the text to only be saved within the app data(internal) you'll need one of the action buttons for copying. So you can highlight a text normally then press that button.

If you highlight a text and press copy from the system popup it'll be in focus and it can be "leaked" per say, at least until it's been overwritten. A semi workout for this which I use is to activate the setting called sync from system clipboard, then I also have a action button for deleting the most recent clipboard item. This way you could copy a password this way and delete it straight afterwards.

There is also an option to delete the recent item from the focus, but keep it in the recent internal clipboard.

Hope this makes sense

Quantum

Quantum A semi workout for this which I use is to activate the setting called sync from system clipboard, then I also have a action button for deleting the most recent clipboard item. This way you could copy a password this way and delete it straight afterwards.

An example would be if Bitwarden failed to paste a password. When you press to copy the password from the app it'll save in the system clipboard(or both depending on settings in FB). After copying and pasting that I would just press the action button for deleting the most recent clipboard item.

As i was writing this I did some more testing.
If you copy something from the system popup and it gets shared to both clipboards, and you press the action button for deleting the most recent clipboard item it'll only delete it from Florisboard. You would need the setting sync to system clipboard for this it work. Activating that setting would always update the system clipboard when you copy to Florisboard though, which is not wanted.

So the only way to safely copy is with the action button through FlorisBoard keyboard.

M113E55ML

Quantum
Gotcha, I configured the keyboard exactly to my liking and I gotta say, its extremly easy to type and the action buttons really help me to be a little bit more efficient working on my phone. I set it up as you described it, copied texts are only stored internaly now with the action button. Its not only faster but also more safe now (hopefully). This is exactly what I needed. Thank you again!

Quantum

Also if you keep all three settings on and copy something, and don't copy something more for a few hours it might delete the copied item from Florisboards history in the keyboard. As it would be shared and Android automatically deletes the focused clipboard within a few hours. This would only happen with all three settings(primarily because sync to system clipboard would be on) on and without copying something new for a few hours.

Quantum

M113E55ML Do be careful about the Bitwarden example I used. In that case if you got a long password pressing the in-app copy button would be the only choice. It'll be copied to both clipboards then. So after pasting it, I would recommend copying a random item through the system pop-up to clear out the password from the system clipboard.

Quantum

Quantum This would also apply to sites where you can't pull up the keyboard.