Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastejacking

github.com

Post reply on HN
Print view View original

91–100 of 246 posts

Re: Pastejacking

#91

Post by logicallee »

cryptoz wrote: post #9

There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…

The proof of concept didn't work for me. I highlighted the text, right-clicked and clicked "copy". I thought it was just broken or not hooking the on-copy properly.

Then I realized that the reason I was doing that instead of ctrl-c is all the times that web sites break ctrl-c. I literally have gotten used to highlighting, right-clicking, and clicking copy, for a "clean" copy :) I wasn't even aware I was doing this.

Of course, web sites can hook right-clicks. It would be funny if they threw up a fake context menu matching the default context menu of the browser and operating you're using, but with evil versions of commands :)

I don't disable or modify javascript, so with that addition it would have tricked me.

Re: Pastejacking

#92

Post by stepanhruda »

vonklaus wrote: post #10

I can't reproduce this in chrome or safari. I have ublock enabled, but a cmd + c gives me the bell in iterm(fail) and if I click edit copy from the drop down, the shell echos "not evil" without a line break as expected. Chrome and Safari. edit: doesn't seem to have unexpected behavior in terminal either. Am I missing something, or does uBlock default deny the scripts that can do this? edit 2: console log: Copying tex…

Same here

Re: Pastejacking

#93

Post by colanderman »

beardog wrote: post #20

I'd like to point out to everyone that isn't aware of it, this can be (sort of) done even without Javascript. Extra text can be hidden with CSS that is easily copied when highlighting other benign text, so be careful even when using Noscript. Edit: Sorry, I didn't read close enough.

Don't forget the alt text of a 1×1 px image.

Re: Pastejacking

#98

Post by jschwartzi »

logicallee wrote: post #91
cryptoz wrote: post #9

There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…

The proof of concept didn't work for me. I highlighted the text, right-clicked and clicked "copy". I thought it was just broken or not hooking the on-copy properly. Then I realized that the reason I was doing that instead of ctrl-c is all the times that web sites break ctrl-c. I literally have gotten used to highlighting, right-clicking, and clicking copy, for a "clean" copy :) I wasn't even aware I was doing this. O…

Right-click hooking could be defeated by inserting a sequence number in the right-click menu and displaying the same sequence number somewhere in the browser window.

I will say that the people who generate event hooks in browsers need to pull their heads out of their asses before this kind of thing becomes necessary.

Re: Pastejacking

#99

Post by Karunamon »

hoodoof wrote: post #27
saganus wrote: post #19

Earlier quoted context omitted.

Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation. The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command.…

In an ideal world I'd get a warning that the copied text did not match the selected text.

iTerm solves this problem from the other side- if you paste something that contains newlines, you get a confirmation dialog.

It defangs this vulnerability nicely.

Re: Pastejacking

#100

Post by rbut »

borski wrote: post #89
rbut wrote: post #7

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

TextEdit is RTF by default - I wonder if you can include control characters to screw with that? I use Sublime/Atom since those are plaintext by default.

Yes, switching TextEdit to default to Plain Text is the first thing I do after installing OSX.
Post reply on HN