How are you going to distinguish between user and programmatically-initated actions? Adding something like a “Secure Copy Key”, akin to control-alt-delete in Windows might work, but it’ll need kernel-level support.
Determining whether the clipboard contents faithfully represent the “visibly-selected” content is also very hard, possibly AI-hard. Suppose I copy an image while zoomed? What size should the clipboard contents be: the original size it’s apparent size?
One mitigation, if you’re worried about this now, might be to run certain programs as another user. I don’t think the clipboard is shared then.
How are you going to distinguish between user and programmatically-initated actions?
That is a deep and fundamental problem within any mediate technology. It's not trivial.
The simple answer is "look for indications from standard user inputs". But those inputs (keyboard, mouse, touchscreen) are themselves sufficiently complex that they can be mimicked, intercepted, or spoofed. There is the problem of distinguishing legitimate from counterfeit confirmation dialogues (already a persistent attack vector for desktop and mobile device users). There is the problem of rogue devices communicating over USB or Bluetooth connections (an argument for a principle of minimum necessary capability for interface ports -- serial and PS/2 connectors have their justifications), though that usually entails other devices being silently added to a system. Though a USB device spoofing an additional keyboard or mouse is also a demonstrated attack.
All of which starts drifting focus away from the key point: what is an unambiguous expression of user intent, and how would you go about ensuring that this is determinable?
The determination of contents question gets to a somewhat different matter: what kind of data are being copied?
I'll admit that I was thinking of the case of text, though there is also image, and conceivably audio and video data.
For text, zoom is irrelevant as that's a display artefact and (at least as I envision it) the goal is to copy the text as displayed, independent of typographical formatting, rather than "glyphs of some size and presentation".
Multi-user clipboard access is dependent on the graphical environment. For X11/Xorg, applications regardless of effective userID, have access to the clipboard.
(X11 also had some early attempts at securing the clipboard, with varying degrees of success. Issues such as grabbing keyboard input, potentially silently, were also an early concern.)
How are you going to distinguish between user and programmatically-initated actions? Adding something like a “Secure Copy Key”, akin to control-alt-delete in Windows might work, but it’ll need kernel-level support.
Determining whether the clipboard contents faithfully represent the “visibly-selected” content is also very hard, possibly AI-hard. Suppose I copy an image while zoomed? What size should the clipboard contents be: the original size it’s apparent size?
One mitigation, if you’re worried about this now, might be to run certain programs as another user. I don’t think the clipboard is shared then.