Dragging the selected text to somewhere else before copying reveals the actual text to be copied (at least on Firefox):
http://i.imgur.com/A7VIWtX.png
Pastejacking
191–200 of 246 posts
Re: Pastejacking
#192Earlier quoted context omitted.
Kind of odd to even bring ethics up when discussing how websites make money. It doesn't matter at all. Ethics is normally used to discuss other people getting harmed by actions, but when all that harm can be removed simply by closing the browser and doing something else it's barely worth talking about. Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that th…
> Who gives a shit? I do. That's probably why I won't be running an effective business any time soon. Being nice and not fucking people over doesn't get you far in highly competitive markets. I strongly second what 'nitrogen wrote[0]. This is very much about ethics. > Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that there are higher quality products ava…
I completely agree and hope that more and more other engineers just say NO to aggressive advertising bullshit. It is not like one has no choice.
Re: Pastejacking
#193I can't believe vim allows executing commands when pasting text. Who on earth thought it was a good idea?
It's not something that vim explicitly allows, it's a side-effect of running the editor in a terminal. When you paste into a terminal, it's as if the keys are actually being pressed, rather than just text inserted. The proper way of pasting into vim, which doesn't have this problem, is "+p (as mentioned in the article).
or
:set pasteRe: Pastejacking
#194This is not the first time this has come up. In fact I wrote an article a while back on how to use this for something legitimate [1] (including mobile support).
It is far easier to execute on the desktop (by watching for the control key press, then creating a hidden div that contains the text to be copied + malicious code if necessary).
Re: Pastejacking
#195There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…
I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.
Would you even need javascript to do it? You could just include that text at the start of each paragraph and hide it with CSS.
Re: Pastejacking
#196For the record you don't actually need to depend on new APIs like "document.execCommand('copy')", simply shifting focus to an off-screen textbox area when ctrl is down will do the trick in 95% of the cases, with full cross browser compatibility.
Most people copy text with right click, which would be unaffected by that. Also mobile browsers.
Re: Pastejacking
#197So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?
Combined with XSS, it may not even have to be a dodgy website. A fair number of projects encourage people to copy and paste scripts into their shell in order to install these days.
Re: Pastejacking
#198There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…
The problem is that browsers are trying to protect the wrong people. An average joe will not even have a terminal to paste commands in.
Most people who use terminals know how to protect themselves, and they can recognize questionable content.
This whole problem shouldn't even exist.
Re: Pastejacking
#199Earlier quoted context omitted.
What absolutely annoys me about this feature is that there are shitty ads which throw this dialog in a loop, making it virtually impossible to close them.
In which browser? Modern implementations shouldn't even make that possible.
Chromium on Linux. Maybe they play some tricks with refreshing or redirecting to make the browser show this dialog again on the next attempt to close the tab, if the browser wouldn't normally do that. Unfortunately, I didn't investigate and don't have links.
Re: Pastejacking
#200Earlier quoted context omitted.
Moralizing about dawnerd’s employment doesn’t really add to the discussion, IMHO.
A new discussion of the ethics of software engineering might be valuable. Other professions have codes of ethics; maybe it's time for software, too.
cf. ACM Code of Ethics and Professional Conduct: https://www.acm.org/about-acm/acm-code-of-ethics-and-profess...