Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't touch my clipboard

alexanderell.is

Post reply on HN
Print view View original

71–80 of 322 posts

Re: Don't touch my clipboard

#71

Post by ma2rten »

brigandish wrote: post #70

This isn't just the web, there's a fundamental leakiness to the Mac's clipboard. I was horrified to realise that apps were being alerted to what was on the clipboard when I copied a a public key from some website and MacGPG (or whichever GPG app it was, they change) popped its head up and told me (something like) "Hi, you've copied a public key, would you like to save it in your keyring?" Does this mean that any curr…

I believe that the clipboard on windows and in x-server work the same way. Programs can also read most files including files that contain private keys.

Re: Don't touch my clipboard

#72

Post by maple3142 »

smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

> I can't think of a single time when I want a site to react to my attempt to copy text off if it.

I think it is needed for some complex web app to handle copying non-text content. Such as images in wysiwyg editor, Google Sheets/Slides...

Re: Don't touch my clipboard

#73

Post by jeffparsons »

brobot182 wrote: post #2

Is there a chrome plugin that prevents this?

How about a Chrome plugin to disable Chrome's _own_ what-you-see-is-not-what-you-get behavior?

I occasionally find it convenient to select hostnames out of a URL in the address bar and paste them into a terminal. Chrome "helpfully" prepends noise to the text you actually copied ("scheme://"), which makes this a PITA.

Re: Don't touch my clipboard

#74

Post by Latty »

smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

Even that won't totally save you. While you can't do exactly this, you can sure get the fun experience of the user getting text they didn't expect in the clipboard when copying without any JS at all.

Text is highlighted on the page based on the code order, not as it appears on-screen (at least in Firefox and Chrome). If you throw elements off-screen with some CSS, you can create a big disparity between what the user thinks they are selecting and what they get when they copy/paste.

e.g: https://jsfiddle.net/Lbc5gsjm/

Not quite as neat as you can't put it dynamically around exactly what you select, but my favourite example of where you could get pretty malicious with it is a “plain text” link that injects a suffix to the hostname when you copy it.

Re: Don't touch my clipboard

#75

Post by zamalek »

0zymandiass wrote: post #44
josephg wrote: post #40

Earlier quoted context omitted.

I’ve used clipboard events for legitimate uses - for example I use them in this pseudo Turing sandpit / visual programming system to move, copy and export content: https://steam.dance/ (you can hold shift for a selection box and once selected you can copy, etc). But I wouldn’t be surprised if stuff like this is the exception rather than the rule. I feel like most news sites and blogs are improved with JavaScript disa…

You're getting far enough into JS knowledge that I don't have. Do you actually need clipboard events, or just dom.event.contextmenu.enabled for that?

Put another way, on a website like draw.io, you need to be able to hook into copy to allow lassoing and copying a set of shapes (and have them remain editable when pasted).

The entire ask (stopping the copyright, and allow clipboard integration) be achieved by allowing pages to augment the clipboard data, which can already be done, but not replace it. Pages would still need to be able to hook paste.

Re: Don't touch my clipboard

#76

Post by na85 »

maple3142 wrote: post #72
smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

> I can't think of a single time when I want a site to react to my attempt to copy text off if it. I think it is needed for some complex web app to handle copying non-text content. Such as images in wysiwyg editor, Google Sheets/Slides...

So trade those apps not working for immunity from JavaScript clipboard hijacking?

I'd be 110% fine with that trade and nothing of value to me would be lost.

Is it possible in Firefox? Anyone know?

Re: Don't touch my clipboard

#77

Post by ridiculous_fish »

brigandish wrote: post #70

This isn't just the web, there's a fundamental leakiness to the Mac's clipboard. I was horrified to realise that apps were being alerted to what was on the clipboard when I copied a a public key from some website and MacGPG (or whichever GPG app it was, they change) popped its head up and told me (something like) "Hi, you've copied a public key, would you like to save it in your keyring?" Does this mean that any curr…

Yes, Mac apps have access to the clipboard; that's why they can paste. Is Windows or Linux different? Honest question.

Please do not give Apple ideas for a "App would like to access your clipboard" dialog.

Re: Don't touch my clipboard

#78

Post by brigandish »

ma2rten wrote: post #71
brigandish wrote: post #70

This isn't just the web, there's a fundamental leakiness to the Mac's clipboard. I was horrified to realise that apps were being alerted to what was on the clipboard when I copied a a public key from some website and MacGPG (or whichever GPG app it was, they change) popped its head up and told me (something like) "Hi, you've copied a public key, would you like to save it in your keyring?" Does this mean that any curr…

I believe that the clipboard on windows and in x-server work the same way. Programs can also read most files including files that contain private keys.

I really care about security and lament that most people don't, but maybe they've the right idea and I'm just wasting my time. There are simply too many holes to plug :/

Re: Don't touch my clipboard

#79

Post by maple3142 »

na85 wrote: post #76
maple3142 wrote: post #72

Earlier quoted context omitted.

> I can't think of a single time when I want a site to react to my attempt to copy text off if it. I think it is needed for some complex web app to handle copying non-text content. Such as images in wysiwyg editor, Google Sheets/Slides...

So trade those apps not working for immunity from JavaScript clipboard hijacking? I'd be 110% fine with that trade and nothing of value to me would be lost. Is it possible in Firefox? Anyone know?

If you really don't mind it will break some websites, then you really can disable it in Firefox.

https://news.ycombinator.com/item?id=22352929

Re: Don't touch my clipboard

#80

Post by Latty »

cortesoft wrote: post #37
smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

I think the wrongest thing is that this is a clear attack vector... make a site with helpful Linux shortcuts, then replace every copy with "curl malicious script and run it, plus a newline to make it run immediately"

As I also noted in a sibling comment, you don't even need JS to do that: https://jsfiddle.net/eaL153uz/
Post reply on HN