Samsung admits Galaxy devices can leak passwords through clipboard wormhole

Samsung has warned that some of its Galaxy devices store passwords in plaintext. The Korean giant’s security SNAFU was reported by a user using the handle “OicitrapDraz” in a post to Samsung’s community forum. “I copy passwords from my password manager all the time,” OicitrapDraz wrote on April 14. “How is it that Samsung’s …

[Pascal Monett]

"sloppy security practices"

Well, we're talking about Borkzilla.

No surprise there.

[CowHorseFrog]

How is this not a bug in Android itself ?

[big_D]

Because it seems to be a One UI specific "feature".

[CowHorseFrog]

Are you guessing or do you know ?

Im pretty sure Android has a clipboard feature and that users and apps can read/write from/to it.

[CowHorseFrog]

Others below say different.

[YetAnotherXyzzy]

Bitwarden, and presumably some other password managers, can clear your device's clipboard some seconds after copying a password to it. Which seems to me to be a better way to do this than rely on the OS or a skin provider to try to guess if what you put in the clipboard might be sensitive and to give it special treatment.

In Bitwarden for Android this is set at Settings - Other - Clear clipboard. I don't recall what the default setting is.

[Steve Jackson]

In the Bitwarden browser extension and the iOS app, the Clear Clipboard default is 'Never'

[Grindslow_knoll]

Default in Keepass

KeePass (and its forks/variants) clear copied passwords by default after a short timeout.

[Guido Esperanto]

Re: Default in Keepass

Whilst the setting exists in keepass...it doesnt actually clear the clipboard.

I just tested by logging into el reg

I have mine set to 1m timeout.....and several mins later...still in the clipboard

[petef]

Re: Default in Keepass

Not on Samsung.

I've just verified again that its password clearing is ineffective on my Galaxy A25. It does work on my old Moto g22 and other platforms.

[david1024]

Re: Default in Keepass

That makes sense as the skin has modified the clipboard behavior and KeePass would need to clear that clipboard in addition to the standard OS one.

Which makes it a Samsung problem as they created this new and nonstandard clipboard that has an insecurely implemented feature. And their answer is just "don't do that"... Classic.