Doesn't seem to work in Safari 9.0.3. This was in the console "Copying text command was unsuccessful".
Pastejacking
11–20 of 246 posts
Re: Pastejacking
#12I wasn't able to get this to work. Do I need to use CNTRL + C?
If you read the source of the website, it has a
> document.addEventListener('keydown', function(event) { ... })
Basically, press any key on your keyboard on the website, and it'll work.
Re: Pastejacking
#13Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?
Re: Pastejacking
#14I wasn't able to get this to work. Do I need to use CNTRL + C?
You do have to use the keyboard shortcut. It executes the snippet regardless of which key sequence you press though ('keydown' event on document).
It may also be because you have no support for execCommand if it didn't work for CTRL+C.
Re: Pastejacking
#15Remind me again why we allow browsers to override OS copy commands?
Re: Pastejacking
#16Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?
On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?
Re: Pastejacking
#17This is one of the innumerable reasons why copying and pasting commands on the fly is wrong. This also includes the awful popular installation commands in the form of "curl -s ... | sh" - which means you are basically giving your computer in the hands of a third party.
> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?
No, but I can verify the hash of the installer before I run it though.
Re: Pastejacking
#18There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…
I don't have data on this, but it's a significant turnoff for me. Unless I really have to share the quote, I never bother cleaning it. It doesn't bug me to the extent that I won't share it altogether (I'll just type it out or copy from Chrome devtools); yet I'll be more hesitant to share from that website from thereon.
Re: Pastejacking
#19So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?
Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation.
The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command. Other could be copy-pasting to an email for example. In those instances it would be obvious that the site is doing something not so kosher and it would be notices pretty soon I guess, depending on the site's popularit
Re: Pastejacking
#20I'd like to point out to everyone that isn't aware of it, this can be (sort of) done even without Javascript. Extra text can be hidden with CSS that is easily copied when highlighting other benign text, so be careful even when using Noscript.
Edit: Sorry, I didn't read close enough.