Why? You just stopped me from using my password manager. And the fact that you don’t realize means you don’t use one. If you work in security and don’t use a password manager (and prevent others from same) you are woefully incompetent and should go find another career.

IIRC (corrections welcome) Windows's window manager broadcasts the contents of the "copy" operation to any application that requests to receive the ? WM_CLIPBOARDUPDATE event... so any windows malware or even legit application with legal fineprint basically gets a plaintext message with the contents even before the "paste" occurs. All running apps are trusted.

Here's an example blog entry from "grumpy-sec"(?) laying this out (2018): https://share.google/0til1YzbF4xFRY7ls

Not to mention newer Microsoft conveniences like logging your clipboard history to your disk so it doesn't go away when your computer reboots, and/or syncing it to the cloud.

https://www.forbes.com/sites/daveywinder/2020/07/11/iphone-u...

https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-a...

That said, for web applications, you are required to do things like use HTTPS for the modern clipboard API, which provides the user some guarantees. Not much works without HTTPS anymore though.

On campus, one service timed you out pretty quickly if you dawdled typing your password. I suggested that you should fail if you type it too fast, instead, to foil shotgun password typing bots, and give users more time for longer passwords.

That was before password managers.

It's hard to get everything right. After some rounds of white-hat password cracking, (the ones I got were so lame)I decided to modify the passwd command to crack passwords on the way in. Much faster with the plain text.

I have distrusted facial recignition since the Columbo episode (spoiler) in which Dabney Coleman sends someone elseout in his car with a face disguise to be deliberately snapped by a traffic camera for an alibi.

The photographically-aware detective notices that the light is wrong.