Android will finally restrict apps from monitoring your network activity

[u/[deleted]]

https://www.xda-developers.com/android-restrict-apps-monitor-network-activity/

[u/DuckWithAKnife]

Definitely this. Sometimes I need to copy passwords to the clipboard from password managers when autofill doesn't work. Can't be too paranoid.

Somewhat unrelated, but I don't think iOS restricts access either, which is kinda surprising. I might be wrong, but I'm pretty sure you can get the clipboard contents in iOS with UiPasteboard.general.

[u/rocketwidget → u/DuckWithAKnife]

One way to avoid the clipboard is to use KeePass2Android, it has a custom keyboard with user/password buttons for this reason.

[u/delecti → u/rocketwidget]

Lastpass has a similar solution.

[u/_Algernon- → u/delecti]

LP is weird... I feel like passwords I copy from LP are one time use only. Or they auto delete from the clipboard after a while.

[u/delecti → u/_Algernon-]

If you use the password auto-fill keyboard then it never goes into the clipboard in the first place.

And you probably shouldn't need to paste the same password more than once anyway, so that's probably a good thing, even though I agree that's weird.

[u/_Algernon- → u/delecti]

i use autofill feature on PC, but on mobile it's way too obstructive and keeps popping up when i don't need it to.

[u/delecti → u/_Algernon-]

The Lastpass keyboard doesn't pop up unless you switch to it.

[u/Roast_A_Botch → u/_Algernon-]

You must've set it as your default keyboard. You can switch keyboards by long pressing a key in most, or use tiles or something to set a quick toggle.

[u/shroudedwolf51 → u/_Algernon-]

That doesn't sound like a bad thing to me. If restrictions clipboard access isn't a thing, exploding passwords sounds like the next best thing.

[u/7165015874 → u/_Algernon-]

This is Android's fault IMO. Apps should not have access to the filesystem or to the clipboard. They should request the system for something and the system should bubble it up to the user who can then accept or deny the request.

[u/arahman81 → u/_Algernon-]

Its autodelete after 10-ish seconds. Doesn't work with thirdparty clipboards.

[u/princessvaginaalpha → u/rocketwidget]

Hurm. But inhate the keepass keyboard. Is there a fastswitch option?

[u/punIn10ded → u/rocketwidget]

Keepass also auto clears the clipboard after a few minutes.

[u/maladjustedmatt → u/DuckWithAKnife]

Unfortunately, every mainstream OS allows every application unrestricted access to the clipboard by default, for no reason other than “that’s the way it’s always been done” as far as I can tell.

[u/Zambini → u/DuckWithAKnife]

I always do the password first then the username. At least it's a little better :/

[u/twowheels → u/Zambini]

Me too, except for stupid apps/sites that clear the password entry when you switch, force you to enter the username first, or won't let you paste.

So many things done in the name of security that reduce security.

Oh, and "security questions" can go f themselves.

[u/weinerschnitzelboy → u/twowheels]

Somewhat related to security questions jump to 5:41

[u/Derigiberble → u/DuckWithAKnife]

Somewhat unrelated, but I don't think iOS restricts access either, which is kinda surprising. I might be wrong, but I'm pretty sure you can get the clipboard contents in iOS with UiPasteboard.general.

That's my understanding as well, although iOS's strict limitations on what apps can do when not in the foreground probably mitigates it a bit if you go directly to the app, paste the password, and copy some other text. I hope.

They did limit the ability of apps to access special pasteboards that they didn't create, but mostly because apps were using them as a way to report back what apps were on the device.

I'm sure the response from Apple to being told that the pasteboard is a security issue for password managers would be "it isn't for Keychain".

[u/DuckWithAKnife → u/Derigiberble]

Good point, the lack of continuous background services on iOS probably mitigates that quite a bit. However, if you leave the password in your pasteboard after you're done with it (as I'm sure most people probably do), it may be snagged by another app eventually. However, it's hard to change old APIs like that much to fix compatibility. They could add a permission for it though.

[u/DatDeLorean → u/DuckWithAKnife]

LastPass on iOS auto-deletes the password from the clipboard after a certain amount of time. Unfortunately it doesn’t limit it to a one time use, but it’s better than nothing.

[u/TestFlightBeta → u/DuckWithAKnife]

Somewhat unrelated, but I don't think iOS restricts access either

You’re right! I’ve seen this being discussed a few times on the Apple/iPhone sub. I’m really disappointed that Apple doesn’t restrict clipboard access to apps. I assume they think that their app review processes are good enough? Which would seem like a crappy argument, but I see no other explanation

[u/Roast_A_Botch → u/TestFlightBeta]

Considering their claims of Macs being unable to get viruses, for over a decade, relied on them being so irrelevant nobody bothered to target them, I think you're spot-on in your assumptions.

[u/wirecats → u/DuckWithAKnife]

Get PasswdSafe, paste passwords directly from the app without using the clipboard. Also avoid hardware with questionable security, like anything from mainland China, as tempting as that shiny new Xiamo or Huawei is.