Android's clipboard protections can be bypassed, and the clipboard itself is a security nightmare
Ctrl+C, Ctrl+v, Ctrl+cve: Bypassing Android's Clipboard Read Security Measures
A Hacker News discussion of a post on bypassing Android's clipboard read restrictions. Commenters argue the clipboard is a legacy feature that would never pass a modern privacy review, since any listening process can grab credentials and personal data. One developer recalls how Android 10's clipboard tightening broke a background dictionary app, while others complain about apps like Belgium's bpost reading the clipboard on launch, and note that GrapheneOS and iOS let users control the permission.
If we never had the clipboard and it was suddenly invented today, it would never pass any major company's privacy or security review.
- iloveyoutwo
GrapheneOS recently added secure paste: https://grapheneos.org/features#secure-paste
- vintagedave
I don’t use Android so I’m not sure what I’m seeing in the embedded video. Is it that there should be a notification at the top of the screen but there isn’t? I thought the article implied it used two different notifications that hide the system one but I see none at all.
- seszett
I've always been irritated by the lack of control on whether apps can inspect the clipboard or not.
The bpost app (Belgian national post) immediately reads the clipboard when it gets opened and I hate this behaviour with a passion. While on the other hand it throws a fit if it ever detects an unlocked bootloader, root access, "suspicious" apps or whatever.
I ended up confining it to an outdated phone with a stock OS along with the bank and identity apps that I cannot avoid. I digress, but the original cause of my irritation was indeed lack of control on my clipboard that ia had noticed thanks to that small notification.
- chinhodado
A long time ago I wrote a dictionary app for my own use, which would show word definition upon the word being copied into the clipboard (e.g. from an e-book reader app). The dictionary app would run in the background and only show the pop up on clipboard event.
Then around Android 10 they tightened security and decided background apps can no longer receive clipboard event. Which makes sense from a security standpoint, but it totally broke my dictionary app. I just wish they're a way as a developer to get around it with my own app.
- streetfighter64
I think allowing any program to read the clipboard at all is a huge mistake. The way it should work is that it's entirely safeguarded by the OS, and the only time an app can see the contents is when it receives them in a Ctrl+V event initiated by the user. This is the way most users, even non-technical, expect it to work, I'm pretty sure.