Just came up with my father again.
He blames me that mother forgot her phone’s and Google password because I recommended against it being a word.
I mentioned encryption, “not necessary unless you’re doing something illegal”.
When mentioning lack of privacy with targeted advertisements, he said that he actually really likes them, because he bought a couple of things he wanted for years.
I don’t really have good arguments.
Is there something that would perhaps also work on Android? Also, how do you move the passwords from password manager into the fields? My problem with clipboard is that anything can read it. Of course, that means there has to be something to exfiltrate the data, but 1 problem is better than 2.
Password managers on Android (and frankly all platforms) actually try to avoid using the clipboard. They prefer the auto-fill service, which is intended for applications just like this. Unfortunately this isn’t working in all cases, but you can also set your password manager as a keyboard (temporarily), so it can directly input a selected username/password without anyone else seeing it.
Examples where I know this is the case are open source keepass options (Keepass2Android, KeepassDX). But I’d assume bitwarden and the like also work this way.
Most of those password managers are also available on android, and automatically clear the clipboard after 30 seconds.
But that’s a bit like plugging a leak when the tanks empty. If they managed to get a tool onto your device to read the clipboard, what else is there to get? They’ll almost certainly have a key logger installed as well, if not a full backdoor.
And that’s assuming they’ll even go through the effort of installing anything and not just using ransomware to brick your device.
The first thing about security is knowing who you’re defending against, and you’re not defending against targeted attacks by nation states (if you as an individual are, you’ve already lost). Your main adversary is spray-and-pray “script kiddies”, maybe the occasional private actor.
Clearing the clipboard also makes it less likely that you’ll accidentally paste your password in a text box somewhere when you meant to tap “Copy” and missed.
I was thinking of Android, and whatever some apps may be doing. They should already be pretty limited in what they can do, so it might be forced to just read the clipboard from time to time and hope you don’t notice (android now shows pop-up when something reads clipboard).
Keypass has apps which supposedly support autofill (I’ve never bothered with setting them up because I hate using a phone), but it might go through the clipboard. You can also set it to clear the clipboard so its at least not just sitting there indefinitely.