Heya,
I shared my previous article about preventing password pasting and someone had a great comment:
The hidden problem many password managers gloss over is how unbelievably insecure the Windows copy-n-paste is in Windows for decades.
Thanks gregw2, that’s a great point, but it does seem like the vendors of password manager software have addressed it.
From 1password’s docs, which defaults to 90 seconds:
For your security, 1Password automatically removes copied passwords from the clipboard.
Other providers also do this to varying degrees:
- Bitwarden has the option to automatically remove clipboard entries, but it is off by default. Here’s some community discussion on the topic (from 2021).
- Keeppass can automatically clear data copied to the clipboard
- Passwordsafe has options to clear passwords on minimize or database lock, as well as to prevent passwords from being including in clipboard history.
- Lastpass has some support for clearing passwords from the clipboard after a set period of time.
If you are writing a password manager, you can also indicate that data should not be included in the clipboard history:
- Windows offers the - ExcludeClipboardContentFromMonitorProcessingformat
- MacOS offers a couple of undocumented identifiers, including - org.nspasteboard.ConcealedType.
While I’m still frustrated at Zwift for making me log in again (and again), the details I found based on gregw2’s comment made me a bit more sympathetic to their stance.
However, another factor in any CIAM system is the protected data and functionality. Whenever you are guarding access, weigh convenience vs risk; this is the threat model. While I haven’t thought too deeply about this, on first glance the risk of someone getting into my exercise app account is pretty low.
Either way, take a look at your password manager settings and make sure your clipboard settings are secure.
Cheers,
Dan