bug BUG - Clipboard Issues

[OLLI_S]

Hello,

I copied some text from the notes of a password entry in Enpass and wanted to paste into the notes of an other password entry. 
But pressing <Ctrl>+<V> did not insert the text.
Enpass cleared the clipboard before I was able to paste the text (I have set the timer to 15 seconds).

Same problem when I copy the text from the notes of an password entry and want to paste it in other applications (like the web browser).

In my opinion the clipboard should be only deleted when the user pressed the "Copy" button behind a field.
Only here the timer should start.
This way I can copy some text from the notes and this information is not deleted after 15 seconds.

Best regards

OLLI

[OLLI_S]

Hello,

I have the same problem in other applications like Excel.

I copied a text from Excel into the clipboard and pasted it into an other cell.
Then I pressed <Arrow-Down> to get to the cell below and pasted the text again.
I could do this 10 times then the clipboard was empty.

Enpass should not delete content from the clipboard when there is no data copied from Enpass.
This is a big problem because I have to copy many items again, because Enpass is deleting them from the clipboard.

Best regards

OLLI

[OLLI_S]

Hello @Vikram Dabas,

In KeePass the timer (that indicates that the clipboard is deleted) starts only when:

• I double-click a username or a password (doing this it is copied to the clipboard
• click in the table on a username or a password and press <Ctrl>+<C>

The timer is not started when I mark any text in the details pane (that is shown at the bottom) and press <Ctrl>+<C>.

So for Enpass I suggest that you:

• start the timer only when the "Copy" button (behind each field) is clicked
• start the timer only when I mark some text with the mouse and press <Ctrl>+<C>
• delete the content of the clipboard only, when the content of the clipboard is still the text that I have copied from Enpass.
  So when I copy a password from Enpass, paste it in a web form and then copy some text from the website (or from any other application) then this information should remain in the clipboard forever (not be deleted from Enpass).

Best regards

OLLI

[Guest Vikram Dabas]

Hi @OLLI_S

We are already aware of an issue with Clipboard that the Enpass app automatically clears the information copied on the Clipboard from System or any other application. Our team has already fixed it, and an update v6.1 with the fixes will be rolled out soon. I appreciate your patience.

[OLLI_S]

Hello @Vikram Dabas,

I suggested above that Enpass should clear the clipboard only, when the content of the clipboard came from Enpass.
Maybe this suggestion is useful for the developers.

Best regards

OLLI

[Guest Vikram Dabas]

Hi @OLLI_S,

The Enpass app already offers the mentioned functionality. But due to the previously shared issue, the things aren't as smooth as expected.

[OLLI_S]

Hello @Vikram Dabas,

Cool, then I am keen about the new version...

Best regards

OLLI

[Caporeira]

In Enpass ich have that after 30 second password will be deleted.

I have new Phone that why i copied view passwords from Enpass to apps and websites. 

But after 1 hour i found all password (with i have copied) in Edge Clipboard (Android 9.0 , Galaxy Note 9).

Now, every time i need to delete Edge Clipboard manualy

How to fix it ?

Edited May 6, 2019 by Caporeira

[OLLI_S]

I see that this is really a security issue!
If all keyboards are in the clipboard and can be read there in plain text.

The Android-App KeePass2Android uses an own keyboard where I have the buttons Username and Password.
This is very secure (no clipboard) but also not very user friendly (I have to select the entry in KeePass2Android first, then switch the keyboard).

So I suggest that you clear the password also from the Android clipboard after you pasted it.

@Caporeira
Do you mean the Android Clipboard (tat is available for all applications)?
Or what do you mean by the Edge Clipboard?

Best regards

OLLI

 

[Caporeira]

15 hours ago, OLLI_S said:

I see that this is really a security issue!
If all keyboards are in the clipboard and can be read there in plain text.

The Android-App KeePass2Android uses an own keyboard where I have the buttons Username and Password.
This is very secure (no clipboard) but also not very user friendly (I have to select the entry in KeePass2Android first, then switch the keyboard).

So I suggest that you clear the password also from the Android clipboard after you pasted it.

@Caporeira
Do you mean the Android Clipboard (tat is available for all applications)?
Or what do you mean by the Edge Clipboard?

Best regards

OLLI

 

Yes, I mean Android Clipboard, tat is available for all applications.

http://inside-galaxy.blogspot.com/2017/07/samsung-galaxy-s8-how-to-enable-and-use.html?m=1

Edited May 7, 2019 by Caporeira

[OLLI_S]

@Vikram Dabas

Will this security issue be fixed too?

Maybe you implement my suggestion:

Quote

So I suggest that you clear the password also from the Android clipboard after you pasted it.

 

[Guest Vikram Dabas]

Hi All,

I can understand your concern regarding the safety and security of your data. Enpass does clear the clipboard after the set time interval. But some devices (Samsung in your case) have extra Clipboard services, when enabled, keep track of historical clipboard data. When Enpass clears the system Clipboard with an empty value, the clipboard manager keeps the previous password as history. Unfortunately, there are no APIs available at the moment which can clear a particular piece of information from such kind of clipboard managers.

We can empty the complete clipboard history filling with empty values consecutively but it will nullify the very purpose of enabling such feature on your phone.

If security is preferred over convenience of clipboard history, you should disable such feature.  Otherwise you will need to manually clear the history in your clipboard manager every time you copy a sensitive information.

Further, Enpass also has a specially designed Keyboard which let you fill the details in third-party apps, browser or even when you’re writing a mail or taking notes. This option will decrease the dependency on Clipboard as it can fill any detail anywhere you want to. You can check the more information here.

[Christos]

The issue still exist in windows and affects clipboard for all users and programs . It was not fixed as is erroneously claimed even in the last version 6.3.1 (585). Also it is a security concern using clipboard even temporary for sensitive data as the one saved in Enpass.