Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastejacking

github.com

Post reply on HN
Print view View original

31–40 of 246 posts

Re: Pastejacking

#31

Post by highphive »

zbuttram wrote: post #25
Unklejoe wrote: post #16

Earlier quoted context omitted.

On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?

I have seen sites that have pages where you're placed in a queue (for whatever reason) and if you leave the page you will be dropped from the queue, so it's nice to have something preventing you from accidentally leaving, but that's the only legitimate use I can think of.

I used to work for a company whose primary product was a web server that companies could buy and run for use purely internally. Our pages involved a lot of data entry that could be lost, so that sort of pop-up can be handy in that situation as well.

Of course a better solution wouldve been a program which doesnt so easily let you lose data in the first place, but this software was long past that.

Re: Pastejacking

#32

Post by nadaviv »

Unklejoe wrote: post #16
landhar wrote: post #13

Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?

On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?

To be able to remind you about your unsaved changes before you leave the page. I personally find the benefits of websites doing that to be greater than the annoyment from websites abusing this functionality. (just an extra click when its being abused, but potentially saving hours of my time when used properly)

Re: Pastejacking

#33

Post by stephentmcm »

Unklejoe wrote: post #16
landhar wrote: post #13

Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?

On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?

It's intended use is for data entry, it's meant to be a prompt for "Hey there's unsaved changes on your 'Super Important Document' are you sure you want to to leave?"

Re: Pastejacking

#34

Post by drauh »

rbut wrote: post #7

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

Or you could "View Source"

Re: Pastejacking

#36

Post by nadaviv »

rbut wrote: post #7

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.

Re: Pastejacking

#37

Post by maxxxxx »

Unklejoe wrote: post #16
landhar wrote: post #13

Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?

On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?

Totally agree. On Firefox these are often modal to the whole browser so you can't even force close the tab.

Re: Pastejacking

#38

Post by beardog »

Viper007Bond wrote: post #24
beardog wrote: post #20

I'd like to point out to everyone that isn't aware of it, this can be (sort of) done even without Javascript. Extra text can be hidden with CSS that is easily copied when highlighting other benign text, so be careful even when using Noscript. Edit: Sorry, I didn't read close enough.

As mentioned in the first sentence of the second paragraph. ;)

Well, i goofed.

Re: Pastejacking

#39

Post by _asummers »

Are there any plugins that detect your clipboard is being manipulated and block the offending script from touching it, or perhaps prompt you? I'm thinking something like uMatrix for that class of JS. I can imagine that being a useful thing, if one doesn't already exist, both from the security standpoint and from the "don't add miscellaneous share crap" standpoint.

Re: Pastejacking

#40

Post by azernik »

chrismonsanto wrote: post #6
fosk wrote: post #4

This is one of the innumerable reasons why copying and pasting commands on the fly is wrong. This also includes the awful popular installation commands in the form of "curl -s ... | sh" - which means you are basically giving your computer in the hands of a third party.

> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?

I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// domain, the page you're copying from also needs to be on a trusted https:// domain.
Post reply on HN