GrapheneOS Overhauls Default Apps and Reworks Clipboard Privacy

GrapheneOS announced on September 6 that it is converting the Messaging app it ships into a modern application, with a release that same day introducing a completely overhauled user interface written in Android Compose, along with a large set of other improvements and bug fixes. In the same thread the project presented a new secure paste feature intended to replace the traditional clipboard APIs.

Secure paste instead of clipboard access

With the new mechanism, users will be able to take clipboard access away from apps and use the built-in alternative instead. It integrates with the standard selection toolbar, input methods, accessibility services and keyboard shortcuts, and the team says it plans to get it merged soon.

Some apps, including those written in Flutter, draw their own text selection toolbar and would not display the new action. To cover those cases, GrapheneOS added a Paste button to the default keyboard; when AOSP Keyboard is replaced by a much better keyboard, that capability will carry over to the new one.

Why clipboard reads are a privacy problem

Android already limits clipboard reads to the app that currently has focus and to the active keyboard. The problem, GrapheneOS argues, is that sensitive data lingers in the clipboard for a while and privacy-invasive apps can still read it when the user returns to them. Android shows a notice when an app reads content set by another app, but by that point the exposure has already happened.

The new approach blocks only the most problematic part of the API. Apps can still read clipboard content they set themselves, which keeps existing workflows intact. GrapheneOS places the change next to Contact Scopes and Storage Scopes as another overhaul of the app permission model, and says many more such features are planned. Access is controlled from Settings through a global default switch and a per-app toggle.

AOSP apps, RCS and what comes next

The messaging overhaul is only the first step. GrapheneOS says it will overhaul or fully replace the remaining AOSP apps. AOSP Gallery is considered so outdated that it will be entirely replaced rather than improved, and AOSP Keyboard may follow a similar path. In the longer term the project wants RCS support in its own app, including the standard end-to-end encryption based on Messaging Layer Security. RCS currently works on GrapheneOS through Google Messages.

On Android, RCS is implemented with code spread across the operating system, Google Messages and Google Play services. GrapheneOS plans to start by building an equivalent to the portion that lives in Google Messages, which would initially require sandboxed Google Play for activation, before that requirement is removed as well. The team notes that RCS is not an open platform in practice and depends heavily on proprietary Google and carrier infrastructure. GrapheneOS says it recently hired a number of developers and will hire more, with donations funding the extra work.