Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful what you copy: Invisibly inserting usernames into text

medium.com

Post reply on HN
Print view View original

151–160 of 200 posts

Re: Be careful what you copy: Invisibly inserting usernames into text

#151

Post by itakedrugs »

koheripbal wrote: post #143
irrational wrote: post #20

How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.

Whenever I paste, I use ctrl-shift-v. It solves this problem and a multitude of other pasting problems.

that doesn't work on my computer (Fedora), but what I usually do is paste it in a box that doesn't allow formatting and then copy it again... but I don't know if it would remove fingerprinting in this case

Re: Be careful what you copy: Invisibly inserting usernames into text

#153

Post by 0xffff2 »

djsumdog wrote: post #149
userbinator wrote: post #89

Earlier quoted context omitted.

If you're only expecting ASCII text, then not being able to show anything else could even be considered a feature to reduce attack area, since any sort of Unicode trickery then becomes impossible.

So what happens when you try to display Chinese or Hindi text? You're just going to get a screen of stars, like you would with unicode square boxes.

"If you're only expecting ASCII text" categorically excludes trying to display Chinese or Hindi text from the program's specification.

Re: Be careful what you copy: Invisibly inserting usernames into text

#154

Post by teolandon »

pasta wrote: post #58
teolandon wrote: post #19

Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newline at the end to make the command run immediately. Ohmyzsh on my machine detects copy-pasted text and warns you.

I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it: cd /tmp; rm -R ~/; ls;

Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Zero-width characters are very limited and can't actually spell out commands (to my knowledge).

It is though, still another reason to be careful when copy pasting.

Now I'm thinking if you can somehow put an ESC character in text so that when you copy-paste it into vim, it goes to normal mode and starts performing commands. Hmm...

Re: Be careful what you copy: Invisibly inserting usernames into text

#155

Post by blackflame7000 »

fluxsauce wrote: post #2

That's a really interesting technique! I'm trying to think of what else could be done with the encryption / description, but tracking is a really effective use case. Could probably encode some other secret messages in there, make a blog post about cheese include a hash to a pastebin. It also reminds me of the importance of having strong validation around things like usernames, because if I had a username that looked…

Not much new can be done encryption wise as this falls more under the category of steganography which is security through obscurity.

Re: Be careful what you copy: Invisibly inserting usernames into text

#156

Post by [deleted] »

kccqzy wrote: post #133
irrational wrote: post #20

How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.

Zero width characters have legitimate uses such as family emojis and certain Indic scripts. You don't want to break these.

[deleted]

Re: Be careful what you copy: Invisibly inserting usernames into text

#157

Post by Zenst »

Cofike wrote: post #32
Mashimo wrote: post #18

Earlier quoted context omitted.

I saw the topic and the first thing my mind went to was eve online :) People could still just make a screenshot and the special character would not be visible, so they implemented hidden watermarks: [0] Then the same alliance would also generate slightly different text for each person. [1] I think things might have changed now days, as everyone is recruiting new players and make it easy for other alliances to put spi…

Pandemic Legion? I haven't looked at the articles yet but I swear I remember them doing that in their forums. Edit: Good old PL.

Yip, did that as spying was a serious part of eve-online, so much metagaming in that game, fun times.

Re: Be careful what you copy: Invisibly inserting usernames into text

#158

Post by gruez »

amelius wrote: post #96
chatmasta wrote: post #78

Earlier quoted context omitted.

I can see a lot of problems with showing different texts to different users in the same place. For example: - on a forum, if the post reads slightly different to each user, and one user “quotes” it, the quote will be of what that user saw, and other users will be able to identify the fingerprint from the quote. - if the fingerprinting script modifies all posts on the forum, then a poster will be alarmed to see his wo…

> on a forum, if the post reads slightly different to each user, and one user “quotes” it, the quote will be of what that user saw, and other users will be able to identify the fingerprint from the quote. Not if the forum intelligently changes the quoted text :)

how do you handle partial quotes? what about broken quotes?

Re: Be careful what you copy: Invisibly inserting usernames into text

#159

Post by always_good »

daveid wrote: post #128
userbinator wrote: post #89

Earlier quoted context omitted.

If you're only expecting ASCII text, then not being able to show anything else could even be considered a feature to reduce attack area, since any sort of Unicode trickery then becomes impossible.

There are more languages in the world than English, not supporting Unicode is not an option for most.

Yes, but thread OP was essentially saying "look how those chars appear when you can only render ASCII." And then the person you replied to said that explicitly.

I'd wager that both of them know there are more languages than English.

Re: Be careful what you copy: Invisibly inserting usernames into text

#160

Post by yzmtf2008 »

A good utility to use to combat all clipboard-related exploits is one of Apple's example code: ClipboardViewer[0]. You can see a screenshot of it displaying the copied code from the demo in the article here[1].

Besides being able to see the hidden characters, you can also see the internal "layers" of clipboard, e.g., how can a rich-text sentence be pasted to both a plain-text editor and a rich-text one.

[0]: https://developer.apple.com/library/content/samplecode/Clipb...

[1]: https://s3.andyfang.me/screenshots/clipboard-viewer.png

Post reply on HN