ID #1071

I encrypt a clip, but it looks the same as it did before.

Q: I encrypted a clip, but no apparent changes have been made. What am I doing wrong?

A: You're probably doing it right - but ClipMate's Key Cache is decrypting the clip on-the-fly every time you look at it. Try this: Go to File | Forget Encryption Key.  Now select another clip, and then come back to the one that you encrypted. It should now prompt you for the key. 

Ok, what happened? 

Instead of nagging you for a key to decrypt the clip that you just encrypted, and nagging for every encrypted clip thereafter, ClipMate keeps the key in memory (it caches it) for a period of time.  When you enter the key into the encryption (or decryption) dialog, you specify a lifetime for ClipMate to remember the key.  This is for your convenience only.  It's like if you have to open 5 doors in a row, you would probably keep the key in your hand, rather than back in your pocket. This is the same idea.  The key is kept in memory, to decrypt any clips that you need. Otherwise, to access your credit card information, you would otherwise have to enter the key several times - when once will do just fine.

As specified in the dialog, ClipMate will remember the key for a specified interval - or until you shut ClipMate down.  Specify zero minutes to have it forget the key immediately.  This obviously works best if you use the same encryption template (fancy word for key) for everything.  If you happen to access a clip that was encrypted with a different key, then it will fail to decrypt, and will prompt you for the key again.

Security Concerns:

The notion of key caching works great if you can trust those around you to leave your computer alone for the duration of the key lifetime.  So set the lifetime accordingly.  If you just want to protect your data from physical theft (stolen laptop, etc.) then long key lifetimes are fine.  If you worry that your co-workers are waiting for your next bathroom break so that they can pounce on your computer, then even one minute may be too long.  I find 10 minutes to be a good compromise - I can usually access enter everything that I need (credit card details, site password, etc.) within 10 minutes.  One last thing to remember though, is that when the key is forgotten, the clipboard still contains the unencrypted data. So if you worry about somebody walking up to your PC, you should "wipe" the clipboard  by overwriting with a "safe to look at" clip.  Just select any other non-encrypted clip, and that's all anyone can paste, once the key expires.

Tags: -

Related entries:

You can comment this FAQ

Comment of CyberRon:
I use encryption with a 60 minute timeout. I have it on the "Safe" for all included clips. When it times out, if I click on that folder - it prompts me for the encryption key. That's all good, but if I cancel from there, the folder opens anyway! I can see the title of some and not others. Since this folder stores some common passwords, and the contents are the same as the title, there is NO protection. Further, if I right click on the still encrypted clips (even the ones stating "This clip is encrypted - unable to display"), I can still hit cancel and edit or see the title, thereby bypassing the supposed encryption protection. This is not very secure. I am using the latest version. The check for updates from the web feature gives me erroneous info as well stating that I don't have the latest. The update from the About works fine. Great product that I have used for years, but is lacking in encryption security with this bug.
Added at: 2015-10-01 18:59

Comment of Joris:
I had exactly this concern when comparing a few different clipboard managers. Usually, if I ctrl+f on the page to immediately find something on how they handle their encryption, security and privacy. I used to use manjaro (kde). And this has a clipboard manager installed by default. You see it, you know it, you never use it and just forget about it. However, I also use keepass for all my passwords. So after a while I took a look at this clipboard manager again... Showing me pretty much all my important passwords.... And then I read that the 'Pro' version get's synced to the cloud. Damn sun, that is very risky business. I would pay NOT to let that happen.
Added at: 2018-11-13 04:05