Ctrl+C, Ctrl+v, Ctrl+cve: Bypassing Android's Clipboard Read Security Measures

GrapheneOS recently added secure paste: https://grapheneos.org/features#secure-paste

A long time ago I wrote a dictionary app for my own use, which would show word definition upon the word being copied into the clipboard (e.g. from an e-book reader app). The dictionary app would run in the background and only show the pop up on clipboard event.

Then around Android 10 they tightened security and decided background apps can no longer receive clipboard event. Which makes sense from a security standpoint, but it totally broke my dictionary app. I just wish they're a way as a developer to get around it with my own app.

I've always been irritated by the lack of control on whether apps can inspect the clipboard or not.

The bpost app (Belgian national post) immediately reads the clipboard when it gets opened and I hate this behaviour with a passion. While on the other hand it throws a fit if it ever detects an unlocked bootloader, root access, "suspicious" apps or whatever.

I ended up confining it to an outdated phone with a stock OS along with the bank and identity apps that I cannot avoid. I digress, but the original cause of my irritation was indeed lack of control on my clipboard that ia had noticed thanks to that small notification.

I think allowing any program to read the clipboard at all is a huge mistake. The way it should work is that it's entirely safeguarded by the OS, and the only time an app can see the contents is when it receives them in a Ctrl+V event initiated by the user. This is the way most users, even non-technical, expect it to work, I'm pretty sure.

I feel like the clipboard is something that is on computers today only because it was invented back when dinosaurs roamed the earth, and we can't get rid of it as a concept because it's so ingrained in computing.

If we never had the clipboard (on any computer, not just Android) and it was suddenly invented today, it would never pass any major company's privacy or security review. Here we have something that allows the user to share any data instantly with any process that happens to be listening, including sensitive things like credentials, personal information, the works. It's a security nightmare! In today's paranoid times, no OS would say yes to a new feature like this, but we keep it because it's legacy and it can't be gotten rid of at this point.