bitwarden
Clear clipboard no longer works on Samsung
Steps To Reproduce
- Enable Clear Clipboard
- Copy a password from bitwarden
- Optionally paste it somewhere else and wait for the time that was set for Clear Clipboard
Expected Result
The clipboard should no longer have the password. What used to happen on Samsung was that the password wasn't deleted but a new empty entry was added into the clipboard. This stopped the password from popping up whenever any text field was selected and could only be viewed by going into the clipboard.
Actual Result
Nothing changes in the clipboard. If you now go to any text field such as in the browser, the keyboard shows the last thing that was in the clipboard which will now be a password or TOTP token etc. This creates a risk of it accidentally showing up if you forget to clear your clipboard.
Screenshots or Videos
Can't provide screenshot as it contains sensitive information.
Additional Context
I think this problem may have been caused by the change #2220.
If i understand correctly, Samsung uses its own clipboard which the clipboardManager.ClearPrimaryClip() function does not work on.
You may be able to replace line 17 in ClearClipboardAlarmReceiver from
if ((int)Build.VERSION.SdkInt < 33)
to
if (Build.MANUFACTURER == "samsung" || (int)Build.VERSION.SdkInt < 33)
but i am not sure.
Operating System
Android
Operating System Version
13
Device
Samsung Galaxy Z Fold4
Build Version
2023.1.0 (5786)
Beta
- [ ] Using a pre-release version of the application.
Hi there,
I attempted to reproduce your issue and was unable to do so on my Android test device. However, my test device is not a Samsung device, and you have helpfully pointed out that this may be a Samsung-specific issue, so I will leave this issue open for further review.
Thank you for your assistance.
@DobbyAHouseElf are you seeing this issue with Samsung Keyboard? If so, I believe it does technically get cleared but it will show as an item to paste on the keyboard suggestion strip until you dismiss the keyboard. After that, it no longer shows (it still remains in clipboard history but doesn't show up as an item to paste in the keyboard or context menu). This is a little different from the behavior I see on Gboard, as Gboard removes it from the suggestion strip as a paste-able item after 10 seconds. Can you confirm if this is what you're referring to?
Hey @mnashat. That is the behaviour i am seeing. I am using samsung keyboard and the copied passwords show up on the context menu. If i close the keyboard by exiting the app or clicking away from a text field, the password does not go away even if i check again the next day. If i click the cross to dismiss the context menu, it will then go away and not show up again. In this case though, if i paste the last thing from my keyboard by pressing paste, it will paste the password.
With the Samsung keyboard, i don't believe there is a way to remove the password from the clipboard history. The old behaviour of Bitwarden used to be to copy an empty item into the clipboard. This means the context menu and clicking paste would no longer paste the password and you would have to go in to the clipboard to see it. Currently, setting the option to clear password after n seconds does nothing on Samsung so i do prefer the old behaviour.
If the new behaviour of removing the item from the clipboard works on other keyboards, maybe it would be better to remove the password, add and empty item in to the clipboard then remove the empty item from the clipboard. That would make it remove the password from the clipboard for devices which support it and add an empty item for devices which do not.
@mnashat This issue is present on Android 13 on a Samsung Galaxy A13 5G. Steps to reproduce are same as above. Additionally, even after exiting the keyboard context and exiting the app, the data is still available for pasting in the clipboard after 5 minutes (timeout set to 30 seconds). Workaround is to use GBoard or some other android keyboard that allows correct behavior.
Workaround is to use GBoard or some other android keyboard that allows correct behavior.
After using Gboard for a while switch back to Samsung Keyboard and check the clipboard history... It still keeps history including passwords (in clear text), even while you use other keyboards. So this does not actually solve anything.
Hi there,
I attempted to reproduce your issue and was unable to do so on my Android test device. However, my test device is not a Samsung device, and you have helpfully pointed out that this may be a Samsung-specific issue, so I will leave this issue open for further review.
Thank you for your assistance.
@DobbyAHouseElf are you seeing this issue with Samsung Keyboard? If so, I believe it does technically get cleared but it will show as an item to paste on the keyboard suggestion strip until you dismiss the keyboard. After that, it no longer shows (it still remains in clipboard history but doesn't show up as an item to paste in the keyboard or context menu). This is a little different from the behavior I see on Gboard, as Gboard removes it from the suggestion strip as a paste-able item after 10 seconds. Can you confirm if this is what you're referring to?
Hey @mnashat. That is the behaviour i am seeing. I am using samsung keyboard and the copied passwords show up on the context menu. If i close the keyboard by exiting the app or clicking away from a text field, the password does not go away even if i check again the next day. If i click the cross to dismiss the context menu, it will then go away and not show up again. In this case though, if i paste the last thing from my keyboard by pressing paste, it will paste the password.
With the Samsung keyboard, i don't believe there is a way to remove the password from the clipboard history. The old behaviour of Bitwarden used to be to copy an empty item into the clipboard. This means the context menu and clicking paste would no longer paste the password and you would have to go in to the clipboard to see it. Currently, setting the option to clear password after n seconds does nothing on Samsung so i do prefer the old behaviour.
If the new behaviour of removing the item from the clipboard works on other keyboards, maybe it would be better to remove the password, add and empty item in to the clipboard then remove the empty item from the clipboard. That would make it remove the password from the clipboard for devices which support it and add an empty item for devices which do not.
@mnashat This issue is present on Android 13 on a Samsung Galaxy A13 5G. Steps to reproduce are same as above. Additionally, even after exiting the keyboard context and exiting the app, the data is still available for pasting in the clipboard after 5 minutes (timeout set to 30 seconds). Workaround is to use GBoard or some other android keyboard that allows correct behavior.
Workaround is to use GBoard or some other android keyboard that allows correct behavior.
After using Gboard for a while switch back to Samsung Keyboard and check the clipboard history... It still keeps history including passwords (in clear text), even while you use other keyboards. So this does not actually solve anything.
Hello everyone,
Thank you all for your input. This is related to how Android on Samsung devices operates; The operating system itself keeps a record of data that was injected into the clipboard, even if that data has since been removed from the clipboard. This is not an aspect of the operating system which Bitwarden can control, and it's up to the vendor to potentially make the necessary changes and possibly allow deactivating that function.
Due to this, I will now close this GitHub report. If anyone has any questions or concerns, please feel free to get in touch with us, and please include a link to this GitHub report if you do so.
Thank you all again,
Hey @SergeantConfused, I am aware that the clipboard can't be cleared on the Samsung keyboard but i still think the old behaviour was better than what happens now. It used to add a new entry which was blank into the clipboard which hides the password when the keyboard opens but doesn't remove it from the clipboard history so can still be viewed if the clipboard button is pressed. Currently, the password is visible any time the keyboard opens until the X is pressed to hide it. The original comment has more details on this.
Is using an approach where a new empty entry is added before clearing the clipboard not an option that would be considered? This would allow the clipboard to be cleared on keyboards that support it and hide it on keyboards that don't unless someone intentionally goes in to the clipboard history.