Privacy exposure of clipboard contents
Aliases: clipboard privacy · clipboard read · clipboard sniffing
What it is
The clipboard often holds passwords, one-time codes, id numbers, sentences not yet public. Because the buffer is global and invisible by default, other apps, page scripts, or system services may read it without the user pasting. Exposure is not “pasted into the wrong field.” It is content leaving the slot without the user’s knowledge.
Why it happens
Historically many platforms let a foreground or even background app query the current clipboard with no user-initiated paste. Pages have obtained it through paste events or polling. A read has no local feedback; users still see their own document. SMS codes and password-manager auto-copy put high-sensitivity objects into the same slot other processes can open, and the window lasts from copy until the next overwrite. Clipboard history that lists old items in the clear widens exposure from “the current item” to “the last n.” Type is unsafe too: what was thought to be a string may carry hidden metadata from the source document. The privacy failure is on the read side; the person who copied is often not the reader.
Studying it
In a controlled environment, list which processes read the clipboard after a copy and before a paste, and whether a UI cue accompanied the read. Independent variables include platform version, whether the app is foreground, and whether a universal clipboard crosses devices. Dependent measures include silent-read count and whether users can name “who read it.” Interviews only yield “I don’t think anyone looked”; use system access logs or the actual permissions of platform APIs.
Where it stops holding
A paste the user performs into a target field is an explicit handoff, not a silent exposure. DLP scanning on a managed enterprise device may be allowed by policy and should still be visible. A cross-device clipboard extends exposure to another signed-in machine; the boundary follows the account, not this screen. A single-task machine with no other apps is low risk and does not represent a phone’s app ecology.
Applying it
- After copying from a sensitive field, shorten dwell time in the slot, or use a one-paste channel that opens only on a user gesture.
- Show a visible cue when an app reads the clipboard without a paste gesture, and keep an access log in system settings.
- Acceptance: copy a one-time code and do not open the target app; if another app or page reads it, that is a fail.