<![CDATA[I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard.]]>I noticed today that an update to the client has made it start proactively reading _everything_ written to the X11 clipboard.

If you keep interesting secrets in your clipboard – particularly, if a password manager uses it as a means of getting the password to where it needs to be – this might be a thing you need to know about!

]]>https://forum.fedi.dk/topic/36ce19b9-d52a-429b-b81f-b63bb21a8cae/i-noticed-today-that-an-update-to-the-linux-zoom-client-has-made-it-start-proactively-reading-_everything_-written-to-the-x11-clipboard.RSS for NodeThu, 03 Sep 2026 01:33:46 GMTWed, 02 Sep 2026 13:06:55 GMT60<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 19:02:08 GMT]]>@simontatham It would be interesting to know what Zoom actually does with the captured clipboard content.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/notbobbytables/statuses/117202991716218853https://forum.fedi.dk/post/https://infosec.exchange/users/notbobbytables/statuses/117202991716218853Wed, 02 Sep 2026 19:02:08 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 19:00:31 GMT]]>@shrub900 @simontatham Yes, compositors can have policy to allow exceptions, particularly for things like wl-clipboard and whatnot. But standard clients *generally* don't have the ability to do this in most desktops (though I think some freestanding WMs don't restrict this by default).

]]>https://forum.fedi.dk/post/https://social.gompa.me/users/neal/statuses/117202985389834230https://forum.fedi.dk/post/https://social.gompa.me/users/neal/statuses/117202985389834230Wed, 02 Sep 2026 19:00:31 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 18:59:29 GMT]]>@simontatham Two solutions I've used, when I have to use Zoom:

1. Use the Zoom Web site. The Web page for the call first makes you try to open the desktop client, but when that fails, a small option appears on the Web page, to do it using Web standards.

2. Dedicated device for Zoom. At an anti-counterfeit-goods startup, after Zoom was sending US calls through CN, seemed prudent to isolate Zoom from eng and ops laptops. I got an iPad, to isolate easier than a dedicated Linux box for Zoom.

]]>https://forum.fedi.dk/post/https://mastodon.online/users/neilvandyke/statuses/117202981353290927https://forum.fedi.dk/post/https://mastodon.online/users/neilvandyke/statuses/117202981353290927Wed, 02 Sep 2026 18:59:29 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 18:47:25 GMT]]>@2something@transfem.social @simontatham@hachyderm.io probably not, afaik there's no way for a web page to read the clipboard without being granted permission https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API#security_considerations

]]>https://forum.fedi.dk/post/https://not.an.evilcyberhacker.net/notes/aqo0irrl8ut702p7https://forum.fedi.dk/post/https://not.an.evilcyberhacker.net/notes/aqo0irrl8ut702p7Wed, 02 Sep 2026 18:47:25 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 17:38:14 GMT]]>@simontatham @nicksilkey, hmm…

$ echo -n foo | xclip -selection primary -loop 1 -verbose
Loops: 1
Using selection: XA_PRIMARY
Using target: UTF8_STRING.
Waiting for one selection request.
    + Creating new requestor for 'Easy Effects' (0x2600002)
    - Deleting requestor for 'Easy Effects' (0x2600002)
$

… er, what? Okay, if it were Clipman, that'd be fine (that's expected), but Easy Effects?

(It does this to XA_CLIPBOARD too, but not XA_SECONDARY. Running 7.2.3; I don't know if 8.x does this.)

]]>https://forum.fedi.dk/post/https://cupoftea.social/ap/users/117147216143373345/statuses/117202661838718883https://forum.fedi.dk/post/https://cupoftea.social/ap/users/117147216143373345/statuses/117202661838718883Wed, 02 Sep 2026 17:38:14 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 17:33:31 GMT]]>@simontatham …and I'm the unreasonable one for being somewhat picky about what I install on my machine.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/notbobbytables/statuses/117202643319297793https://forum.fedi.dk/post/https://infosec.exchange/users/notbobbytables/statuses/117202643319297793Wed, 02 Sep 2026 17:33:31 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 16:54:28 GMT]]>@simontatham and let me guess: they didn't say shit about it. "Bug fixes and improvements!!!"

]]>https://forum.fedi.dk/post/https://polyglot.city/ap/users/116920690631779955/statuses/117202489765355129https://forum.fedi.dk/post/https://polyglot.city/ap/users/116920690631779955/statuses/117202489765355129Wed, 02 Sep 2026 16:54:28 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 16:48:06 GMT]]>@simontatham That's typical malware behaviour

]]>https://forum.fedi.dk/post/https://mastodon.social/users/mschfr/statuses/117202464714368959https://forum.fedi.dk/post/https://mastodon.social/users/mschfr/statuses/117202464714368959Wed, 02 Sep 2026 16:48:06 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 16:45:23 GMT]]>@simontatham
tool "firejail" may help. not sure though.

it is good time to mention such tool, which can limit lot of permissions for program.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/zetabeta/statuses/117202454012455131https://forum.fedi.dk/post/https://mastodon.social/users/zetabeta/statuses/117202454012455131Wed, 02 Sep 2026 16:45:23 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 16:28:30 GMT]]>@simontatham If I ever have to use Zoom, it's through the browser.

]]>https://forum.fedi.dk/post/https://beige.party/users/mast0d0nphan/statuses/117202387637596494https://forum.fedi.dk/post/https://beige.party/users/mast0d0nphan/statuses/117202387637596494Wed, 02 Sep 2026 16:28:30 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 16:27:51 GMT]]>@simontatham i see, with them also removing features from the browser version and adding a popup saying to use the app i can't see this as anything over than malicious

]]>https://forum.fedi.dk/post/https://tech.lgbt/users/nonbinarycoder/statuses/117202385100150495https://forum.fedi.dk/post/https://tech.lgbt/users/nonbinarycoder/statuses/117202385100150495Wed, 02 Sep 2026 16:27:51 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 16:21:19 GMT]]>@simontatham@hachyderm.io

Does this affect Zoom Web?

]]>https://forum.fedi.dk/post/https://transfem.social/notes/aqnvavy8sl9m1xp6https://forum.fedi.dk/post/https://transfem.social/notes/aqnvavy8sl9m1xp6Wed, 02 Sep 2026 16:21:19 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 16:07:29 GMT]]>that sounds like a security nightmare.

]]>https://forum.fedi.dk/post/https://mastodon.social/ap/users/117071166918807778/statuses/117202305017133601https://forum.fedi.dk/post/https://mastodon.social/ap/users/117071166918807778/statuses/117202305017133601Wed, 02 Sep 2026 16:07:29 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 15:50:07 GMT]]>@glent ah, yes, now I see that in the web version of Settings it's there, a long way down a very large page.

But no luck, I'm afraid. I turned that off; pressed Save; quit and restarted the local Zoom client, since you said the web settings might only be loaded at startup; and alas, the unwanted clipboard slurping is still happening.

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/simontatham/statuses/117202236735183424https://forum.fedi.dk/post/https://hachyderm.io/users/simontatham/statuses/117202236735183424Wed, 02 Sep 2026 15:50:07 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 15:41:47 GMT]]>@glent that sounds like a very plausible thing to try, but I can't find that setting!

In the Zoom client's Settings dialog box, the "My account" entry in the left sidebar only offers me some links to the web version of my account settings, an option to make a voice recording for smart voice recognition, and a list of all the clients logged in to my account.

Other plausible sidebar entries, like "Meetings & webinars" or "Share screen", don't have any option of that kind either.

Searching for 'clipboard' in the whole settings box, via the search tool at the top of the left sidebar, only finds "Automatically copy invite link to clipboard" in the Meetings tab.

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/simontatham/statuses/117202203925148387https://forum.fedi.dk/post/https://hachyderm.io/users/simontatham/statuses/117202203925148387Wed, 02 Sep 2026 15:41:47 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 15:40:08 GMT]]>@kamstrup @simontatham Back in the days, like at the end of the last decade Zoom also ran a web server which opened a port wide open so users would not need to press a button.

I guess there is certain kind of work culture in the house.

]]>https://forum.fedi.dk/post/https://mas.to/users/rpsu/statuses/117202197458274741https://forum.fedi.dk/post/https://mas.to/users/rpsu/statuses/117202197458274741Wed, 02 Sep 2026 15:40:08 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 15:34:10 GMT]]>@simontatham ah yes, zoom who, last i used it some years ago, ran a C compiler in the background every 10s. I am very surprised they are, once again, doing crazy shit 😂😭

]]>https://forum.fedi.dk/post/https://fosstodon.org/users/kamstrup/statuses/117202173981483178https://forum.fedi.dk/post/https://fosstodon.org/users/kamstrup/statuses/117202173981483178Wed, 02 Sep 2026 15:34:10 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 14:50:03 GMT]]>@simontatham
TL;DR: Zoom is now a password stealer.

Glad I mostly use autotype, rather than clipboard. Also, I believe many password managers can do one shot paste, to prevent accidentally pasting your password in the wrong window. Which would not prevent this, but would have caught it.

]]>https://forum.fedi.dk/post/https://c.im/ap/users/116216635389955538/statuses/117202000485697290https://forum.fedi.dk/post/https://c.im/ap/users/116216635389955538/statuses/117202000485697290Wed, 02 Sep 2026 14:50:03 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 14:21:30 GMT]]>@simontatham what did it do when you put a large hex number in the clipboard

]]>https://forum.fedi.dk/post/https://mastodonapp.uk/users/idiot/statuses/117201888269720776https://forum.fedi.dk/post/https://mastodonapp.uk/users/idiot/statuses/117201888269720776Wed, 02 Sep 2026 14:21:30 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 14:16:10 GMT]]>@simontatham for cases like that, there are often external data control protocols used to make it work. because it’s easy to inspect what clients use what protocols, you can make sure only a client you trust uses those protocols. standard clients don’t tend to use them though, generally only clipboard related utilities and the like

]]>https://forum.fedi.dk/post/https://mastodon.social/users/shrub900/statuses/117201867307496868https://forum.fedi.dk/post/https://mastodon.social/users/shrub900/statuses/117201867307496868Wed, 02 Sep 2026 14:16:10 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 14:10:09 GMT]]>@shrub900 I see, thanks. So a side effect would be that command-line pasting tools, like 'xclip -o', also couldn't work?

That's quite a big tradeoff for some users – me in particular. I use that kind of workflow a lot. As and when I move towards Wayland, I'll have to work out what to do about losing that.

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/simontatham/statuses/117201843638501192https://forum.fedi.dk/post/https://hachyderm.io/users/simontatham/statuses/117201843638501192Wed, 02 Sep 2026 14:10:09 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 14:07:45 GMT]]>@simontatham@hachyderm.io @shrub900@mastodon.social for one the program has to explicitly pass in an input event that triggered the paste action (and the compositor can decide to for example say that mouse movement isn't valid for that)

]]>https://forum.fedi.dk/post/https://not.acu.lt/notes/aqnqj3p0gwhttps://forum.fedi.dk/post/https://not.acu.lt/notes/aqnqj3p0gwWed, 02 Sep 2026 14:07:45 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 14:07:19 GMT]]>@simontatham generally on wayland only applications with keyboard focus can get access to the clipboard, which would prevent zoom from getting the clipboard content when it’s running in the background.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/shrub900/statuses/117201832462515217https://forum.fedi.dk/post/https://mastodon.social/users/shrub900/statuses/117201832462515217Wed, 02 Sep 2026 14:07:19 GMT<![CDATA[Reply to I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard. on Wed, 02 Sep 2026 14:02:54 GMT]]>@simontatham they have also changed the zoom client to always be running in the background. That's it for me, will avoid.

]]>https://forum.fedi.dk/post/https://mementomori.social/users/harald/statuses/117201815076740122https://forum.fedi.dk/post/https://mementomori.social/users/harald/statuses/117201815076740122Wed, 02 Sep 2026 14:02:54 GMT