Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

111–120 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#111

Post by tuetuopay »

loxias wrote: post #103

I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean: 1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access) 2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) 3) some combination of the above…

From what I gathered in the article, it's #1.

Usually webpages cannot read the clipboard, and instead rely on the browser/os/whatever sending them its contents when the user ctrl+v or right-click-paste. It would then be received as a javascript event.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#112

Post by Zetobal »

teo_zero wrote: post #72
Zetobal wrote: post #2

Who pastes something and executes it without a second look?

If I understood it correctly, the snippet in TFA injects a return as well, so by the time you give the second look, the commands had already been executed. In a following snippet, the terminal scrolls 100 lines and prints no prompt, so a user is tempted to press Enter just to check what's going on. You can count this as a form of phishing, if you want.

#

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#113

Post by oasisaimlessly »

codedokode wrote: post #105
yndoendo wrote: post #49

Earlier quoted context omitted.

I cannot stand any Operating System that does not utilize left-click highlight and middle click paste. This is great secondary buffer to the clipboard Ctrl+C && Ctrl+V. I HATE the middle click scrolling feature that Windows uses, it is not user-friendly and not needed in the age of the scroll-wheel. Another reason you have to pay me to use Windows.

Having two clipboards is a bad decision. Also, trackpad doesn't have middle button.

Yep; I often wish there were three buffers!

All trackpads I've tried support middle click via a three-finger tap.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#114

Post by loxias »

tuetuopay wrote: post #111
loxias wrote: post #103

I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean: 1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access) 2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) 3) some combination of the above…

From what I gathered in the article, it's #1. Usually webpages cannot read the clipboard, and instead rely on the browser/os/whatever sending them its contents when the user ctrl+v or right-click-paste. It would then be received as a javascript event.

Ok, thanks. That matches my model of the world. You said "usually", are there any particular exceptions you have in mind?

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#115

Post by arp242 »

macNchz wrote: post #92
Aardwolf wrote: post #57

Earlier quoted context omitted.

Whether it's unexpected or not depends on the user, you could as well say ctrl+v pasting in windows is unexpected if you don't know this shortcut. Middle click paste in linux is a standard feature this OS has always had

The problem being that middle click does other stuff, like opening links in new browser tabs.

Well, we can have a long discussion about what is "better" or not, but in the end it's just a preference, and also a long-standing paradigm.

It's fine to dislikes it; everyone dislikes some features (e.g. personally I really dislike autoscroll). The thing is that it's not "unexpected" because it's been like this for >30 years, since the 80s. Nor is there anything wrong with it: it's just something you can like or dislike.

Or to put it in another way: if I wanted my Unix system to behave like Windows or macOS then I'd be using Windows or macOS.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#116

Post by tuetuopay »

loxias wrote: post #114
tuetuopay wrote: post #111

Earlier quoted context omitted.

From what I gathered in the article, it's #1. Usually webpages cannot read the clipboard, and instead rely on the browser/os/whatever sending them its contents when the user ctrl+v or right-click-paste. It would then be received as a javascript event.

Ok, thanks. That matches my model of the world. You said "usually", are there any particular exceptions you have in mind?

I said "usually" as an abundance of caution, I cannot say there isn't a browser out there that lets you read the clipboard. Or some kind of flaw. Or electron.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#117

Post by deathanatos »

loxias wrote: post #103

I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean: 1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access) 2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) 3) some combination of the above…

It's #1, but it's the primary selection, not the clipboard.

On Linux, there's the clipboard, which is the Ctrl+C/Ctrl+V that most people are familiar with.

There's also the "primary selection", which is the currently highlighted text. That selection can be pasted into a different app or text box with middle click. So you can really quickly do highlight, middle-click, highlight, middle click.

The primary selection is stored separately from the clipboard too, so it won't overwrite the contents of such.

But, because setting the primary selection is just selecting text, if JS selects text, then it sets the primary selection. Compare with the clipboard: JS cannot normally set the clipboard except in certain contexts (the OP goes into these).

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#118

Post by dsissitka »

loxias wrote: post #103

I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean: 1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access) 2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) 3) some combination of the above…

It's one but for your primary instead of your clipboard. The JavaScript forces your selection so it affects the output of your Shift + Insert and middle click.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#119

Post by arp242 »

loxias wrote: post #103

I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean: 1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access) 2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) 3) some combination of the above…

It's the first, but only for PRIMARY (which you paste with middle-click). CLIPBOARD (Ctrl+C/Ctrl+V) is unaffected.

(Well, technically, it doesn't actually "inject" anything, it just changes the selection, and arguably it's "working as intended").

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#120

Post by deathanatos »

… that they blocked the author's extension is like icing on this WTF cake.

This is absolutely a bug, and almost certainly a security bug. If you consider pastejacking the clipboard within the threat model that you want to account for, selection-jacking like this is absolutely within it, as it's a superset in terms of bad behavior.

(… but browsers have long maligned the primary selection on Linux. Neither Firefox nor Chrome have behaved properly for a long time, so it's not really surprising that they don't wanna when it comes to this bug. The primary selection is incredibly useful, but unique to Linux and even there, poorly understood amongst its userbase due to being a bit tricky to discover.)

Post reply on HN