Ask HN: When will clipboard support finally come to browsers?

#1

Post by sgehlich » Wed, Sep 25, 2013, 8:21 PM UTC

I'm working on a project where automatic copy & paste would come in very handy. A simple Clipboard API with Clipboard.set and Clipboard.get would be awesome - but browser simply don't support it yet - not even Webkit!

I read a lot about security concerns, but seriously, we are already able to record the microphone and webcam using JavaScript with the user's approval. Why isn't there any way to do the same for the clipboard?

Thanks in advance for your answers :)

Re: Ask HN: When will clipboard support finally come to browsers?

#2

Post by joshstrange » Wed, Sep 25, 2013, 8:33 PM UTC

Well the security concerns are VERY valid, in theory after getting your permission to access the clipboard I could poll it every X milliseconds and fire off whatever I get to a third-party service. If you look at Flash's implementation for getting data from the clipboard[0] you can see they mention all sorts of limitations like "Because of security restrictions on accessing clipboard data, this example does not work in Flash Player. In Flash Player, you can only call the getData() method of the Clipboard object in a paste event handler.". I can see there being support possibly for setting the clipboard via JS but I'm struggling to find a good reason to want to get the clipboard data? Why not have the user just paste it in a textbox and listen for on change or something like that?

[0] http://help.adobe.com/en_US/FlashPlatform/reference/actionsc...

Re: Ask HN: When will clipboard support finally come to browsers?

#3

Post by sgehlich » Wed, Sep 25, 2013, 8:36 PM UTC

joshstrange wrote: post #2

Well the security concerns are VERY valid, in theory after getting your permission to access the clipboard I could poll it every X milliseconds and fire off whatever I get to a third-party service. If you look at Flash's implementation for getting data from the clipboard[0] you can see they mention all sorts of limitations like "Because of security restrictions on accessing clipboard data, this example does not work…

Okay, good point on getting the clipboard data. But what about setting it? I don't see a big security concern there.

Also, what if the user has to give permission to read the clipboard per default, but he can also check 'Always allow for this tab'?

Re: Ask HN: When will clipboard support finally come to browsers?

#4

Post by yogo » Wed, Sep 25, 2013, 9:00 PM UTC

sgehlich wrote: post #3

joshstrange wrote: post #2

Well the security concerns are VERY valid, in theory after getting your permission to access the clipboard I could poll it every X milliseconds and fire off whatever I get to a third-party service. If you look at Flash's implementation for getting data from the clipboard[0] you can see they mention all sorts of limitations like "Because of security restrictions on accessing clipboard data, this example does not work…

Okay, good point on getting the clipboard data. But what about setting it? I don't see a big security concern there. Also, what if the user has to give permission to read the clipboard per default, but he can also check 'Always allow for this tab'?

No thanks. I definitely don't want a site to have the ability to set my clipboard. It will be much easier to help spread malicious links (visiting a site using paste and go). Plus what about the annoyance of having something in your clipboard that you were going to paste somewhere then due to visiting another site it gets wiped?