Bug 334646 - Password managers can't clear clipboard entries
Summary: Password managers can't clear clipboard entries
Status: RESOLVED DOWNSTREAM
Alias: None
Product: plasmashell
Classification: Plasma
Component: Clipboard (show other bugs)
Version: 5.15.3
Platform: unspecified Linux
: NOR wishlist
Target Milestone: 1.0
Assignee: Esben Mose Hansen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-05-12 10:26 UTC by Tim
Modified: 2023-01-08 14:07 UTC (History)
11 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tim 2014-05-12 10:26:03 UTC
Certain applications (eg keepass) will clear the clipboard after a few seconds.
Also command line applications such as xsel are able to clear the clipboard. (xsel -c -b)
When klipper is running, the behavior I was expecting was that the latest clipboard history item be removed. 

Reproducible: Always

Steps to Reproduce:
With klipper running
1. Copy something (eg: "a") to the clipboard
2. Copy a other thing (eg: "b") to the clipboard
3. In a command line terminal, run 'xsel -c -b
4. Paste
Actual Results:  
1. clipboard content that should have been removed ("b") is pasted
2. clipboard history shows the item that should have been deleted ("b") as well as the Item that should have been pasted ("a")

Expected Results:  
1. Previous clipboard item ("a") be pasted in stead of ("b")
2. The latest clipboard entry ("b") be absent from the history

My work around for now is either to disable klipper (but I like klipper!) or to manually clear all the history after I have used keepass (but i forget!)
Comment 1 GHPS 2015-02-25 15:45:45 UTC
I can confirm the bug, i.e. missing feature: Individual items can't be removed from the clipboard. 

The Problem: On one side this is a shortcoming I feel in my everyday work because I copy tasks/snipplets via the clipboard and I'm used to delete the finished entries with DEL.

On the other side this can be a security flaw since e.g. KeePass has the said feature to copy a user name/password to the clipboard and remove this entry after a short period of time. For this to work it relies on the respective clipboard function - which is currently absent.

Solution: Klipper function to delete items - both manually (with DEL) and via 'xsel -c -b'
Comment 2 GHPS 2015-04-28 18:08:40 UTC
Update: In Plasma 5 there's some progress: 'xsel -c -b' works, i.e. the last entry is removed from the clipboard. Unfortunately it's still visible in Klipper's menu...

While Klipper is left unchanged (no delete item menu, no dbus signal to delete a single item), the newly designed, now default Clipboard widget has a context menu which includes a "Remove from history" option.
Comment 3 sadam36 2015-06-25 16:05:18 UTC
Clearing klipper after locking KeePassX was working (at least most of the times) for me in KDE4, but it's not in Plasma 5. So I suppose this is some kind of regression? Or KeePassX had some workaround to clear klipper and now this possibility is removed?  

I would appreciate making this work again as it's somehow security flaw in my opinion- if you forget to clear klipper manually everybody who has manual access to your computer can know your recently used password.
Comment 4 kreutzer.peter 2018-01-28 17:09:17 UTC
Same issue with QtPass for password management.
item is not remove from clipboard.

Would be great if this could be resolved as it is really a security flaw.
Comment 5 Erik Quaeghebeur 2018-09-12 12:08:38 UTC
Issue still present in current version.

Maybe there is a workaround for the programs trying to clear from klipper, as one developer manages to do this: https://www.dvratil.cz/2018/05/plasma-pass/
Comment 6 al F 2022-08-01 08:20:54 UTC
The title of this bug should be changed to "Password manager can't clear clipboard entry" to better reflect the severity. Will try to change it, but not sure if I can.

It also affects other password managers, like Bitwarden (both the desktop client and the browser extension.

I also think that it should not necessarily be the last entry that is deleted - there may be situations when you copy and paste a password, then copy something else before the timeout. The copied entry should somehow be marked with an expiration timer so that it gets reliably deleted after use. I too can do this manually, of course, but I too forget...

This bug is still alive with Linux/KDE Plasma: Operating System: Manjaro Linux
KDE Plasma Version: 5.24.6
KDE Frameworks Version: 5.96.0
Qt Version: 5.15.5
Kernel Version: 5.15.57-2-MANJARO (64-bit)
Graphics Platform: X11
Graphics Processor: Mesa Intel® HD Graphics 530

ADDITIONAL INFORMATION
There is a bug report regarding this at https://github.com/bitwarden/clients/issues/1047
Comment 7 michaelk83 2022-09-07 06:26:42 UTC
(In reply to al F from comment #6)
> There is a bug report regarding this at https://github.com/bitwarden/clients/issues/1047

As noted in https://github.com/bitwarden/clients/issues/1047#issuecomment-1097429744 :
> KeepassXC sends copied passwords with custom mime data (application/x-nspasteboard-concealed-type
> on OS X, x-kde-passwordManagerHint on Linux, and ExcludeClipboardContentFromMonitorProcessing on
> Windows) to hint for passwords not to be stored in history

Klipper supports the `x-kde-passwordManagerHint` flag AFAIK, so password managers should be setting this flag when copying sensitive data.