Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

181–190 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#181

Post by charcircuit »

arp242 wrote: post #180
charcircuit wrote: post #165

Earlier quoted context omitted.

FYI Window's clipbord history has better security than what desktop Linux has. For example desktop Linux currently has no way to copy an image and specify that the contents are sensitive and should not be added to the history. Poor API design and the inability for APIs like the clipboard to evolve are part of the reason why desktop Linux's security keeps falling behind other operating systems.

How do you copy something without adding it to the clipboard history? I can't find how to do that? Either way, I'm pretty sure it could be added if someone cared enough, e.g. by adding a new target. It just seems to me that if someone is able to access your clipboard history you've lost already, and the entire feature seems more of a convenience thing than a security thing.

>How do you copy something without adding it to the clipboard history?

Win32: https://learn.microsoft.com/en-us/windows/win32/dataxchg/cli...

WinRT: https://learn.microsoft.com/en-us/uwp/api/windows.applicatio...

>Either way, I'm pretty sure it could be added if someone cared enough

That's the problem. Ironically, not enough people care about improving the security and privacy of desktop Linux.

>It just seems to me that if someone is able to access your clipboard history you've lost already

Do you not see how it could be problematic if sensitive things were logged and persisted to disk?

Edit: Some clipboard managers on Linux do have an undocumented way to do this by adding an additional format to what's being copied with a MIME type set to x-kde-passwordManagerHint and data set to "secret".

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#182

Post by Zuiii »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Any gesture-like feature is unintuitive if you don't take the time familiarize yourself with it. It's one of my absolute best UX improvement features in linux, I just wish it was available on other operating systems.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#183

Post by arp242 »

charcircuit wrote: post #181
arp242 wrote: post #180

Earlier quoted context omitted.

How do you copy something without adding it to the clipboard history? I can't find how to do that? Either way, I'm pretty sure it could be added if someone cared enough, e.g. by adding a new target. It just seems to me that if someone is able to access your clipboard history you've lost already, and the entire feature seems more of a convenience thing than a security thing.

>How do you copy something without adding it to the clipboard history? Win32: https://learn.microsoft.com/en-us/windows/win32/dataxchg/cli... WinRT: https://learn.microsoft.com/en-us/uwp/api/windows.applicatio... >Either way, I'm pretty sure it could be added if someone cared enough That's the problem. Ironically, not enough people care about improving the security and privacy of desktop Linux. >It just seems to me t…

Most clipboard managers don't store to disk but in memory, AFAIK anyway.

And your link just shows some programmatic access? How do I access that as a user when I press Ctrl+C? I suppose it's "useful" for things like password managers, but since anything can read the clipboard anyway it's a very limited protection. If something is so sensitive that you're using that special programmatic way of storing it then you should be using the clipboard but an actually secure mechanism.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#184

Post by joveian »

talent_deprived wrote: post #23

For disabling X11 middle click paste, I found an interesting SO post but the best answer I saw and tested myself and it works, was the one by Suraj Inamdar about one third of the way down the page: https://unix.stackexchange.com/questions/24330/how-can-i-tur... What sucks is I use middle click paste all the time so now I'll have to decide if I want to leave it disabled for potentially improving security.

That removes your middle mouse button entirely! (Unreliably due to the use of numbers with xinput, which can change; xinput can take names to avoid that issue). The issue will remain if the primary selection is pasted into a terminal by other means (personally, I use a key combination rather than mouse button) and won't be an issue if clipboard.autocopy is set to false in about:config in Firefox (per torgard's comment).

I've also set dom.event.clipboardevents.enabled to false since I don't want websites messing with the clipboard.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#186

Post by opan »

Aardwolf wrote: post #41
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I love middle click paste, in combination with ctrl+c/ctrl+v paste it's a second clipboard, which allows to do one kind of refactoring in between doing some other refactoring in code (as just one example). I didn't know wayland doesn't support that either, one more thing to add to the list of things it doesn't support like screenshots, xclip, mouse/keyboard automation, etc...

Everything you listed works on Wayland.

Grim for screenshots, slurp for selection (similar to maim). wl-clipboard works like xclip with its wl-copy and wl-paste commands, I use it extensively in scripts. There is ydotool (not to be confused with xdotool) for kb/m automation. Highlight + middle click paste also works as expected and I use that many times a day. Primary selection is also available to wl-clipboard with a -p arg for both copy and paste.

t. actual daily Sway user for several years now

It's insane to me how much misinformation is spread about Wayland by people who just don't even try it. I guess people want to hate it.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#187

Post by opan »

macNchz wrote: post #92
Aardwolf wrote: post #57

Earlier quoted context omitted.

Whether it's unexpected or not depends on the user, you could as well say ctrl+v pasting in windows is unexpected if you don't know this shortcut. Middle click paste in linux is a standard feature this OS has always had

The problem being that middle click does other stuff, like opening links in new browser tabs.

It also closes tabs, and can allow scrolling. These things are in different contexts and don't interfere. You'd need to be in a text box to middle-click-paste. It won't mess up opening a link in a new tab.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#188

Post by opan »

wavemode wrote: post #133
Aardwolf wrote: post #41

Earlier quoted context omitted.

I love middle click paste, in combination with ctrl+c/ctrl+v paste it's a second clipboard, which allows to do one kind of refactoring in between doing some other refactoring in code (as just one example). I didn't know wayland doesn't support that either, one more thing to add to the list of things it doesn't support like screenshots, xclip, mouse/keyboard automation, etc...

Seems like the real solution is clipboard history, which I make extensive use of on KDE and Windows. Never felt the need for middle click paste.

This doesn't cover the use-case of having unique info in both at the same time, allowing you to paste in your desired order. I have a script where I read from the primary selection, modify the text, and put it on the clipboard. I use this along with something more like a regular clipboard manager to complete a task. Combined I can highlight some text, put other info on my main clipboard to paste right away, then run my script that uses the primary selection afterward without going back to re-copy the first text.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#189

Post by idbehold »

deathanatos wrote: post #120

… that they blocked the author's extension is like icing on this WTF cake. This is absolutely a bug, and almost certainly a security bug. If you consider pastejacking the clipboard within the threat model that you want to account for, selection-jacking like this is absolutely within it, as it's a superset in terms of bad behavior. (… but browsers have long maligned the primary selection on Linux. Neither Firefox nor…

Take this logic one step up: it's X11 which is allowing applications to set the middle click buffer. X11 should only be allowing that to be set from direct user-interaction as any application could be nefariously setting it.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#190

Post by doix »

opan wrote: post #186
Aardwolf wrote: post #41

Earlier quoted context omitted.

I love middle click paste, in combination with ctrl+c/ctrl+v paste it's a second clipboard, which allows to do one kind of refactoring in between doing some other refactoring in code (as just one example). I didn't know wayland doesn't support that either, one more thing to add to the list of things it doesn't support like screenshots, xclip, mouse/keyboard automation, etc...

Everything you listed works on Wayland. Grim for screenshots, slurp for selection (similar to maim). wl-clipboard works like xclip with its wl-copy and wl-paste commands, I use it extensively in scripts. There is ydotool (not to be confused with xdotool) for kb/m automation. Highlight + middle click paste also works as expected and I use that many times a day. Primary selection is also available to wl-clipboard with…

> It's insane to me how much misinformation is spread about Wayland by people who just don't even try it. I guess people want to hate it.

I suspect it didn't work at one point and then people ditched it and have that as their memory. I tried to switch to sway, a bunch of stuff didn't work like I expected and I just switched back to i3, this was probably 3-4 years ago at this point.

I assume it's probably gotten better, so I don't go around commenting. But I fully believe people did try it and it didn't work for them (at some point) and they just ditched it.

Post reply on HN