Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

31–40 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#31

Post by macNchz »

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland.

Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a few significant annoyances unintentionally pasting secrets or private messages in the wrong place before I got rid of it.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#33

Post by somat »

demondemidi wrote: post #28

You guys have a middle button? Maaaan. :) Edit: did y'all miss the smiley at the end of my comment?

The trick with a laptop are Thinkpads. some models have three physical "mouse" buttons.

I was not looking for this as a feature when I bought one a few years ago but it had them and it has proved the thing I like about the machine the most.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#34

Post by SubiculumCode »

The problem is the middle paste option in Firefox. To turn it off do as follow:

    open a new tab
    type: about:config
    Accept the prompt
    type middlemouse.paste
    change value “true” to “false” (double click or switch on the rightside)
    restart firefox
--does this solve it?

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#36

Post by sshine »

itvision wrote: post #26

This has been known for at least a decade or two already. And a much worse attack exists: you copy e.g. shell code from the page, and instead of what you see, you paste something evil in your terminal.

This is another exploit that relies on ‘display: none’.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#37

Post by somat »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Conversely the select/single-click-paste is one of my favorite features of X11 it turns assembling text from various sources from a deliberate action to a natural movement. Objectively it is not that much of an improvement, it only removes two steps from normal copy paste. drag paste comes close but I never use it for some reason. But it is surprising how infuriating going back to command paste is(for example if I am on windows)

I do agree that overloading the button is terrible. I like the scroll wheel but wish there was a separate middle button. And I loathe middle button auto scroll, I regard it as a useless, user hostile feature.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#38

Post by foobarian »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Meanwhile it is one of my favorite ever features that speeds up many tasks during my average workday. :-) It takes a bit of care though especially if there are prod-impacting sessions open.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#39

Post by omoikane »

b112 wrote: post #9

You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...

The bug here is that between the "copy" and "paste" operations, a script running in the background can win the race to rewrite clipboard contents before "paste" happens. Thus the defense needs to happen on the "paste" side, changing the "copy" side would result in the same race.

A solution is bracketed paste[1] as mentioned in earlier comments[2], which would allow the user to examine a pasted command before running it.

[1] https://en.wikipedia.org/wiki/Bracketed-paste

[2] https://news.ycombinator.com/item?id=37966924

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#40

Post by cesarb »

somat wrote: post #33
demondemidi wrote: post #28

You guys have a middle button? Maaaan. :) Edit: did y'all miss the smiley at the end of my comment?

The trick with a laptop are Thinkpads. some models have three physical "mouse" buttons. I was not looking for this as a feature when I bought one a few years ago but it had them and it has proved the thing I like about the machine the most.

Some Dell models too, when you choose the keyboard model with a trackpoint they come with the extra set of three physical mouse buttons above the trackpad.
Post reply on HN