Clipboard is not cleared in case of Software Licenses

stevejobs

The clipboard content is not automatically cleared if it was copied from an item in the Software Licenses category. Items copied from the Passwords category seem to be cleared as expected.

Steps to reproduce:

1. Open the Preferences of 1Password. Click the Security tab, set Clear clipboard contents after 45 seconds (shorten from the default value of 90 to 45).
2. Open Terminal.app and run this shell snippet to print out the clipboard content every 10 seconds

while true; do date; pbpaste | tail -2 ; echo; sleep 10 ; done

3. Copy an item from the 1Password mini window.
4. Observe that an item in the Passwords category is cleared after 45 seconds, but an item from the license key field in the Software Licenses remains forever.

Note: I use the Software Licenses category to keep my SSH private keys, since a password field in the Passwords category does not allow line breaks.

An example has been attached to this ticket.

---

1Password Version: 7.3.2
Extension Version: Not Provided
OS Version: macOS Mojave 10.14.6
Sync Type: Dropbox

ag_ana

Hi @stevejobs!

I use the Software Licenses category to keep my SSH private keys, since a password field in the Passwords category does not allow line breaks.

What type of field are you using in your Software Licenses category to store this password?

stevejobs

Thanks for the quick response (in the other issue too :) ). I'm using the field license key to store SSH private key files.

Lars

@stevejobs - I'd have to check, but that sounds right to me. Certain field-types are cleared after 30 seconds (like TOTP codes), because they're obviously secrets you don't want available permanently. But that assumption is not present for other field types -- or at least not as clearly -- so not all copying to the system clipboard is equal in 1Password. However, I do have what may be a workaround for you: if you're using 1Password 7 for Mac, you can invoke the mini with the ⌥⌘\ keyboard shortcut, then drag any field value over into your bash window. Doing it this way bypasses the system clipboard because it uses native messaging. Would that work for you?

stevejobs

Thanks for the work around tip. It works although takes a while to get used to. However I'm more concerned about the way 1Password protects my data. I thought everything stored with 1Password is secure by design. Quoting from 1Password website:

Fundamental design choices were made to protect everything you store in 1Password so you can trust it with your passwords, financial information, and more.

Apparently not everthing is protected... Is there anyway to check what kind of data is protected and what is not?

Ben

@stevejobs

Everything you store in 1Password is encrypted, but if you copy that data out of 1Password and onto the system clipboard we can't protect it there. We also can't protect against it being read out of your web browser (e.g. by a malicious extension) once entered into a web form. 1Password is one tool in the security toolbox. It isn't an excuse to not exercise good security hygiene in other aspects as well.

Ben

stevejobs

Well, there is a good reason why we have the option Clear clipboard contens after xxx seconds under the Security tab of the Preferences window. An average user would expect this is a preventive measure to protect his/her data. If part of the data is not the target of this preventive measure then I think it must be stated out clearly.

ag_ana

Thank you very much for taking time out of your day to to share this feedback! We appreciate every idea that could make 1Password even better.

I can see how this could be useful to you, so while I cannot make any promises, I can tell you that I have shared your feedback internally :)

Once again, thank you and have a wonderful day!