An update to the Linux Zoom client (version 7.1.5) has introduced a new behavior: it now proactively reads everything written to the X11 clipboard. This could be a concern for users who store sensitive information in their clipboard, such as passwords managed by a password manager.
This behavior appears to be specific to the CLIPBOARD selection, which is typically used for explicit copy-paste operations (Ctrl+C, Ctrl+V), and not the PRIMARY selection used for traditional X11 mouse-based copy-paste.
It seems Zoom detects clipboard changes via the XFIXES extension and requests a paste from the new owner immediately. This was discovered when a "one-shot paste" tool, designed to fulfill a single paste request and then terminate, began closing immediately upon starting because Zoom was requesting a paste. This is similar to a behavior previously observed in Slack.
Discussions around this issue have explored the mechanics of X11 selections and the concept of "one-shot paste" tools. Tools like xclip can be used to demonstrate this behavior, showing how Zoom's constant clipboard requests can interfere with such tools.
There's also a debate about the future of display servers, with Wayland being proposed as a more secure alternative to X11. However, users have noted that Wayland's clipboard access restrictions might also impact other functionalities, and its implementation and compatibility can still be challenging for some users, especially those with highly customized desktop environments.
Some users have suggested alternative solutions, such as using the Zoom web client or a dedicated device for Zoom calls, to mitigate potential security risks. The exact purpose of Zoom's clipboard monitoring remains unclear, with speculation ranging from proactive meeting invitations to more nefarious data collection.
