Convert To Trusted file

[adw]

@KarlinQubes

Seeing as this has gained a decent amount of discussion already, I’m compelled to ask: Can you give me a rough hypothetical about what the attack vector is for clipboard copying in to the vault? Is it that the Qube itself may be compromised and thus you don’t really have control over what is on the clipboard in that Qube at the time you copy to the global clipboard?

Would that not still just be text? Is there some concern that a particularly obscure set of text entered in to a Keepass DB could crass it or execute something?

Yeah, the idea is that if the source qube is compromised, it can inject whatever text it wants into the source qube’s clipboard, which then gets picked up by the global clipboard and pasted into the vault. Even “just text” can be damaging, depending on what that text is and where it’s entered:

Now, it’s less likely that something like this will occur if you’re pasting into a password manager, but it’s not inconceivable that there could be a vulnerability in the password manager, and the risk of blindly pasting untrusted text into certain terminal emulators would be even higher.