CapeSoft PassPaste
Documentation

• Introduction
• Features
• Why Is Pasting Prevented?
• JumpStart
• Multi DLL
• Template Reference
• Implementing in HandCode
• Class Reference
• Support
• Installation
• Distribution
• License & Copyright
• Version History

Recent versions of Clarion have disabled the ability for a user to paste text into a Password field [1]. While this may be advantageous in some circumstances, it greatly weakens security in general by preventing the use of secure (ie long and random) passwords generated by password managers. PassPaste is a small template that allows users to paste text into password fields, using either Ctrl-V, or Right-Mouse-Button / Paste.

All the proceeds collected from this template go to charity (over and above our normal charitable contributions.) For a list of the charities we regularly support see our Social Responsibility page. If you cannot afford this product please contact us and we will arrange a free copy for you.

[1] This is likely not an overt action by SoftVelocity. It is likely to be a side effect of the way a native Windows entry field is being used.

• Allows the user to Paste text into password fields, using Ctrl-V, AppsKey, or the Right Mouse popup menu.
• Clears the clipboard after the text is pasted.
• Supports AnyText for popup menu translation. A simple embed point provided for other translation systems.
• Supports Legacy and ABC applications, Clarion 8 and later.

Having a password in the clipboard is not ideal because the clipboard is available to any program on the computer, and is plain text. Thus if your computer is compromised with some kind of malware, then that program may be able to inspect the clipboard from time to time and extract passwords from there (This argument ignores the issue that malware can just as easily log keystrokes.)  Equally if, after using the clipboard, the password is left there then another user at your keyboard can retrieve it simply by pasting into say Notepad (if you leave your desk.)

Unfortunately the solution (preventing a Paste) does not fix the root problem. The user has already copied the password into the clipboard, so the damage (if there is any) has already been done. Indeed since the user flow has been interrupted it's possible they may now forget to clear the clipboard.

PassPaste works to resolve the problem by not only allowing the Paste, but then immediately clearing the clipboard. Since you are pasting into password field the program is uniquely able to determine that the clipboard contains a password, and that this password is now no longer required.

Programs that prevent pasting are making an attempt to educate users, by not accepting the password they "teach" the user not to copy the password into the clipboard in the first place. This approach might work if it was universally adopted, but that is not the case [2]. Since the consensus is that very long, random passwords are the only protection against off-site brute-force attacks, the use of Password Managers is by far the best solution to that vulnerability. Given the choice between (ineffective) local clipboard protection and the risk of short passwords being brute-forced, the accepted security practice is to promote long, random, passwords and to allow Paste from the clipboard.

References

[2] All modern browsers, including Chrome, Firefox, Safari, IE and Edge allow pasting into password fields.

1. Add the PassPaste Global Extension to the application.
2. On a window with a Password field add the PassPaste local extension to the window.
3. Set the properties as you wish. See the Template Reference for a list of properties and what they do.

If you have a multi-dll system (ie multiple apps) then you need to add this template to the DataDLL app.
In this app turn on both settings on the Multi-DLL tab.

Then add the Global extension to any other apps that contain password fields. In these apps only the first checkbox on the Multi-DLL tab should be on.

Then, in those apps, add the Local extension to any windows that contain a password field.

Global PassPaste Template

Local PassPaste Template

Implementing PassPaste in hand-coded procedures is very straightforward.

Adding the PassPaste class to your project

Adding a PassPaste object to your Procedure

A single object is able to provide paste support for any number of controls on the window. The main methods are Init and TakeEvent. Assignment code must be embedded into the derived Paste method for the class to work. This is usually done for you by the template.

Properties

Methods

Your questions, comments and suggestions are welcome. See our web page (www.capesoft.com) for new versions. You can also contact us in one of the following ways:

CapeSoft Support
Email
Telephone	+27 87 828 0123

To download the latest installation please visit the CapeSoft Downloads page.

To install extract the Installation Program from the SAF file using the free CapeSoft Safe Reader (download for free from https://www.capesoft.com/utilities/Safe/safereader.htm).

Run the Installation Program for your version of Clarion.

There are no files to distribute.

This template is copyright © 2021 by CapeSoft Software. None of the included files may be distributed. Your programs which use PassPaste can be distributed without any PassPaste royalties.

This product is provided as-is. Use it entirely at your own risk. Use of this product implies your acceptance of this, along with the recognition of the copyright stated above. In no way will CapeSoft Software, their employees or affiliates be liable in any way for any damages or business losses you may incur as a direct or indirect result of using this product