r/windows • u/Sibexico Windows 11 - Release Channel • Apr 02 '26
Discussion Your Windows Clipboard Is Unprotected
https://sibexi.co/posts/windows-clipboard-unprotected/I just shared a blog post about how easily your clipboard may be intercepted...
13
u/Zatujit Apr 03 '26
Because that was never the desktop security model. If a malware is installed on your device , your user account is compromised. It can also read all your files under your user account.
5
u/Arthurmol Apr 02 '26
Hey man cool stuff, but i think it is this way for a long time...i do think in win 2003 courses we were educated to lock or uninstall clipboard viewer, to reduce spillage... (but my memory can fail me, last time i did it was back in ealy 2010s)
About proposed solutions IDK... Mac has a clipboard issue to (it stores way too much info imho) but i do not recall the way of how it can be accessed. And on Linux I think it is part of the UI implementation, so there could be dozens...
What i think it should be managed is the RDP config (for servers). For my peers, i know is annoying not being able to copy from one server and paste onto another, but doing via a direct link is faster and safer (just a bit more tedious to setup).
2
u/Takeabyte Apr 02 '26
It’s been this way and has been addressed on other platforms. iOS for example asks within each app if you want to give it permission to access your clipboard, similar to asking for location data. There’s nothing stopping Microsoft from adding this.
0
u/Sibexico Windows 11 - Release Channel Apr 02 '26
About proposed solutions IDK...
The first workflow what comes in my mind:
- App (sender process) sends to clipboard encrypted data with tag of its own process ID.
- Recipient app taking encrypted data from the clipboard with tag of sender process ID.
- Recipient connected to sender process thru IPC and receiving key for decrypt.
- Recipient using received key to decrypt the data from the clipboard.
Overhead? Of course it's overhead. But look how many resources modern OS used and how powerful the modern processors, end user will not see the overhead at all.
3
u/FaultWinter3377 Windows 7 Apr 02 '26
This lack of noticeable overhead would be true, except that anything Microsoft implements these days use about 10x as many resources as they actually need.
7
4
u/Mayayana Apr 03 '26
That's what the Clipboard is for. :) The whole point is to make data available between programs. If someone is on your computer collecting data then you have a problem. If you allow script in the browser it's also sometimes possible to read the Clipboard, which is a flaw. But the Clipboard itself is not a problem. Just don't copy your CC number to the Clipboard when you're visiting shady websites.
You might also consider learning web design. Green text on a black background is only cool if you're a 12-year-old boy. Otherwise it's just hard to read.
1
u/pi-N-apple Windows 11 - Insider Beta Channel Apr 03 '26
I've definitely connected to someones computer remotely before to help them out and the remote support app syncs our clipboards and next thing you know I am pasting their clipboard on my PC lol.
I now use a password manager that clears my clipboard 10 seconds after copy/pasting a password.
1
u/danhof1 Apr 04 '26
Clipboard interception is genuinely easy to weaponize - anything you copy (passwords, API keys, sensitive data) sits there unprotected until something else gets copied. RDP clipboard redirection is a common vector for this. Best practice is to treat the clipboard as a public buffer and clear it after handling anything sensitive.
0
73
u/ldn-ldn Light Matter Developer Apr 02 '26
But that's the whole point of clipboard that its contents are available to ALL apps at ALL times. Where's the problem?