termux / termux/termux-api

Handle sensitive information with termux-clipboard-set or another command

Open
#332 9 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

API command request enhancement
Dominant language
Java
Stars
4.3k
Forks
920
PR merge metrics
No merged PRs in 30d

Description

Feature description

The Android clipboard is insecure for sensitive data. If one wanted to handle sensitive data in Termux (for instance by using the pass package), they may use termux-clipboard-set as a means of moving the data to another app. It would be great if there was a more secure way of Termux sending sensitive data to other apps, especially since the inclusion of the pass password manager implies Termux can be used with sensitive data.

Possible solution:

Copying:
The data can be read from stdin or piped into a new Termux-api command; termux-copy-sensitive and temporarily stored in Termux (not the system clipboard)

Pasting to another app:

  1. the autofill framework. This would required Termux:API to be manually enabled as an accessibility service
  2. Have Termux:API act as a new keyboard/input method with a button to "paste" the data that was previously "copied" using termux-copy-sensitive.

I took both solutions from the README of the repo I previously linked to

Reference implementation
I don't use these password managers, but the README also mentions LastPass and 1Password. It says both apps implement the autofill and custom keyboard/input methods

Have you checked if the feature is accessible through the Android API? Yes
Do you know of other open-source apps that has a similar feature as the one you want? (Provide links)
Found out about one a few days after opening this issue. See below

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the Termux:API command model and the Android autofill framework and input-method documentation referenced in the issue. Compare the proposed temporary sensitive-data flow with the cited reference implementation, then define and implement one secure transfer path with clear cleanup and user-enablement behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
mobile, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.