Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

191–200 of 257 posts

Re: Don't copy paste from a website to a terminal

#191

Post by simoncion »

boomlinde wrote: post #159
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not burned in the sense that I executed some hidden commands in the terminal, but I've tried pasting snippets of text in IRC and ended up pasting several lines of text that absolutely did not select. While this may not be a huge issue in practice, I have no idea what motivates the inclusion of functionality that manipulates the clipboard in the browser. I don't really think that the analogies of anyone swerving on th…

> I have no idea what motivates the inclusion of functionality that manipulates the clipboard in the browser.

I'm not sure, but I expect that it's the same sort of thing that motivates the inclusion of the ability to enable page content obfuscation schemes that -say- scramble a page's plaintext, but use CSS styles and JS voodoo to make it appear like the page contains only comprehensible text.

I expect that -when using such a scheme-, you'd need to be able to modify what is being tossed on to the clipboard, as -I expect that- the inbuilt selection tool will pick up your garbage data as well as the intended text. [0]

Edit: To be a little more practical, you could (for instance) use the ability to modify the contents of a clipboard to -say- create custom representations of your web application data formats and allow relatively easy transfer between instances of the software.

[0] Yes, I do recognize that allowing copy and paste kinda defeats the purpose of this scheme, but the scheme is something that I've seen in the wild.

Re: Don't copy paste from a website to a terminal

#192

Post by angelbob »

jacquesm wrote: post #180
angelbob wrote: post #161

Earlier quoted context omitted.

Whereas I kinda assume the NSA is already using it, and that's one of the big reasons to care.

I would hope that with all the resources they command that the NSA would not resort to methods involving such co-operation by their intended victims. Though anything goes I guess and why bother doing something intricate certain if something dumb and chancy works just as well.

They frequently use methods where you have to double-click on an email attachment. Most people consider cut-and-paste from a web site to be safer than that.

Also, non-TLS web sites can potentially be hijacked in flight, so this could happen even if the site in question wasn't directly cooperating.

Re: Don't copy paste from a website to a terminal

#194

Post by ogig »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

> Has anybody been personally burned by this?

I've seen a gist posted at bitcointalk (a scammerful place) to do currency convert in php or js, can't remember. The gist contained hidden code at column 300. Not that I was personally burned, but yea, I've seen in it the wild.

Re: Don't copy paste from a website to a terminal

#197

Post by jnbiche »

pjungwir wrote: post #48
jnbiche wrote: post #33

Earlier quoted context omitted.

I'm not understanding this approach. Cat is for files. How would you use it to protect against this trick? Do you mean you pre-typed "> /dev/null" and then pasted his git command where the cat is?

Like many Unix commands, if you don't give cat any files to read, it reads from stdin instead. So first he runs the command (as he typed it), and then while cat is waiting for input he pastes in whatever he copied from the website. Another handy convention is the magic "-" filename (which is not actually a file). Many tools interpret that to mean stdin/stdout. For example here is a trick to copy a tree of files: tar…

I'm glad I asked, I wasn't realizing that `cat` would read from stdin in this case. Makes sense, given the Unix piping philosophy (which I use to great effect on buffers in vim).

But wrt your trick to copy a tree of files, what's wrong with `cp -r src dest`, or `scp -r src desthostname:/dest` if it's over a network? Is there some advantage this way?

Re: Don't copy paste from a website to a terminal

#198

Post by burke »

hyperpape wrote: post #127
jonas21 wrote: post #120

Earlier quoted context omitted.

Does your school really have a "three strikes and you're out" policy for plagiarism? It seems like that would almost encourage cheating, up to the point where someone gets their second strike.

He failed the exam. I assume that "three strikes and you're out" means out of the school. At the schools I went to, I don't think a single plagiarism incident would get a student kicked out. They would fail the assignment or the class.

At my school, it was made very explicit that you'd be immediately expelled for plagiarism (subject to appeal, IIRC, but yes: One strike.)

Re: Don't copy paste from a website to a terminal

#199

Post by hueving »

headwayoldest wrote: post #93
haswell wrote: post #90

Earlier quoted context omitted.

This is a great point, and something I often wonder about as well. I think it's reasonable to think that only a compromised site or site run by someone with ill-intent would pose any real risk. And in such a scenario, it's going to get out pretty quickly that the site is compromised/dangerous. While this doesn't help that theoretical set of initial victims, it just doesn't feel like a credible risk worthy of too much…

Little Snitch serves this purpose to some extent on OS X. If the malicious hidden script invoked a remote server I'd get a popup asking if I would like to allow it.

Assuming the script didn't inject malware in a way that allowed traffic bypassing little snitch.

Re: Don't copy paste from a website to a terminal

#200

Post by jnbiche »

wyldfire wrote: post #42
jnbiche wrote: post #33

Earlier quoted context omitted.

I'm not understanding this approach. Cat is for files. How would you use it to protect against this trick? Do you mean you pre-typed "> /dev/null" and then pasted his git command where the cat is?

No, I just put my terminal into a mode where I could see what I pasted without any possibility executing it. If you don't give cat any arguments, it reads from stdin and writes to stdout. I could have just as easily opened vim/emacs/notepad and done the same, or for that matter, written the contents to an actual file instead of redirecting the contents to /dev/null.

Cool, I've used cat for years and never realized it would do that if you don't have something actually piping to it. Totally makes sense now.
Post reply on HN