Clipboard history and cloud sync widen the leak radius of secrets

What it is

A password was just copied into the buffer; the next copy was supposed to bury it after paste into a login field. Clipboard history keeps it in a browsable list. Cloud sync sends it to a phone and a tablet. History and cloud sync widen the leak radius: a copy that was meant to be on this machine, for an instant, dead on the next overwrite, becomes a replica that can still be fetched across time and devices. This is not a privacy-principles entry. It does not argue minimization or that the default should be off. It is only that once this desktop channel is stretched by history and sync, the people, devices, and moments that can stumble on the payload multiply.

Why it happens

The default clipboard’s leak surface is “this machine, right now, the next paste.” History lengthens time: one-time codes, card numbers, and chart numbers from hours ago still lie in the list. Sync lengthens space: other devices on the same account become new paste ends, including a tablet already lent out and a conference-room PC still signed in. The implicit channel already hid its contents; the history UI then deliberately spreads past contents in a list, so shoulder surfing and screen share scan a column of secrets, not only the next paste. Password managers warn against the clipboard because of this step: the copy act did not change; persistence and broadcast changed the set of receivers. People still model “gone after paste.” The radius is no longer that model.

Studying it

Have people copy a sensitive string (one-time password, address, document fragment), then try to retrieve it under different delays, devices, and with or without a history panel. Add a second person using a second device on the same account.

Independent variables: history on or off, device-to-device sync on or off, wait after copy, whether the second device shares the physical room. Dependent variables: rate at which the secret can still be fetched, which device the fetch happens on, whether people know history or sync still holds a replica, how many list items are visible under shoulder surfing.

Fake passwords in the lab lower caution; people may flip through history on purpose. Closer to use is inserting one “copy the one-time code” into their own daily task, then asking afterwards where it still lives. Do not infer “users do not care” from the fact they still copy—that shows the channel is handy, not that they accept a copy in the list and a copy in the cloud.

Where it stops holding

With history and sync both off, the radius returns to the default buffer and this claim’s increment vanishes. If enterprise policy forces them off, an in-app history built by the product puts the radius back. End-to-end encrypted sync still enlarges the device set; it only drops observers on the wire. The signed-in conference-room PC can still paste. Accessibility clipboard speech reads history items aloud, and the leak becomes auditory. Drag-and-drop does not use this buffer and is out of scope.

Applying it

• After copying a password, one-time code, or payment number, offer “remove from history when used” or never write it into history; do not rely on the next copy to overwrite.
• Cloud sync should not carry types marked secret; if the system cannot do that, show which devices will see it before the first cross-device paste.
• Grade the history panel by content: mask long digit strings and password-like items by default; do not spread a plaintext list on a shared screen.
• Verify: copy a one-time password, open the history panel and another signed-in device, and count how many places it remains readable and for how long. Mark the string secret and repeat; the readable places should drop. Open history during screen share and count unmasked plaintext rows.

Related

• Within the group: K2.10.1 The clipboard is an implicit inter-app channel whose behavior must be predictable · K2.10.2 Copied formats determine what the paste target can accept · K2.10.3 System services let other apps invoke a function without switching
• Adjacent: O1.08 Contextual integrity · O3.17 On-screen exposure of sensitive information
• Search terms: clipboard history · universal clipboard · clipboard sync