Can a browser get the data on my clipboard? Data could be for example my temporary password?
Any browser or operating system that allows this?
Asked
Active
Viewed 2,811 times
5 Answers
11
For Javascript, Internet Explorer allows you to block that specific functionality, without disabling Javascript altogether.
In Tools -> Internet Options -> Security -> -> Custom Level, you can find the following setting:
Sadly, I wasn't able to find an equivalent setting in neither FF nor in GChrome.
Additionally, however, as it has been mentioned, there are other ways besides Javascript for a browser/webapp to access your clipboard. Some have some forms of controls available too, but I'm not familiar with all of them (e.g. Silverlight has CAS, but I dont know SL well enough to know how to block it).
AviD
- 72,708
- 22
- 137
- 218
9
Note that other client side technologies such as Java applet, Adobe Flash, Silverlight may also have access to your data in the clipboard.
mauris
- 258
- 1
- 9
4
On Windows, any process (running on the same desktop, IIRC) can monitor changes to the clipboard with the SetClipboardViewer API call.
PasswordSafe, a well known password management tool, allows you to drag and drop the password onto a web page, bypassing the clipboard altogether.
ixe013
- 1,922
- 15
- 20
-
2Also, even if you do copy the password to the clipboard, PasswordSafe ensure removing it from memory after a short time, e.g. when it gets minimized. – AviD Apr 08 '11 at 08:57
-
Any information on how they do this? – OrigamiEye Nov 21 '19 at 10:03
3
The simple answer Yes. But this is usually done through Javascript, maybe some other ways as well. But if you disable Javascript it will help you with your concerns for security. I'd suggest you read this.
Split71
- 186
- 2
-
then why isn't notscript & noscript installed by default or maintained by google & mozilla? we need bigger security!! :P :) – LanceBaynes Mar 22 '11 at 08:04
-
@johnny8888 - because a lot of users would complain that it broke website 'x'. Google, Mozilla and others are trying to push for greater acceptance but it also requires web app developers to develop their code to not rely on insecure mechanisms. It's a slow process:-) – Rory Alsop Mar 22 '11 at 08:56
-
@Rory - I agree and this is very true. If you started eliminating a lot of Java and other 3rd party coding in web browsers you'll find a lot of websites will look like crap/not run properly. – Split71 Mar 22 '11 at 13:48
-
@LanceBaynes I think that when you copy-pasted the link broke. It is for NoScript, yes? NoScript is awesome. – MikeP Oct 18 '16 at 15:59
0
Clipboard is not secure, especially if you use IE browser as it allows certain function that allows a malicious page to run a javascript that can read your stored clipboard data and then submit a form with that data... Or write junk data and overwrite anything (important) you had.