Ya, fucking with paste is a pet peeve of mine. What's a good argument for fucking with paste?
The only one I've ever heard is "security." Sometimes people try to "yeah it's because for security we don't want some tool to paste credentials or clickjacking mumble something malware hacking clipboard spyware javascript browser" but most of the time the truth is "our sec people need to show controls for hardening the authentication process so they came up with that and we just did it because it wasn't worth the fi…
I consider it a reduction in security because it makes entering proper random passwords more difficult - either I have to paste it somewhere else first (and leave it in plaintext on my screen) OR I have to use a more memorable/shorter password. When I can paste passwords, they can be as long as possible and never are actually visible in any way.
> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…
Not sure why OP linked to a fork instead of the original. But the original has a bookmarklet version if you would prefer an alternative. https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-fi...
This one is the version linked by the Firefox addon [0]. Honestly can't tell if one or the other is better but I like having it automatically enabled. Considering it hasn't been updated for years (but still works) I'm not particularly worried.
Ya, fucking with paste is a pet peeve of mine. What's a good argument for fucking with paste?
When you have a confirmation field, like signups that require you to type your email and then verify your email, blocking paste stops the user from typing a typo and then copy-pasting the typo into the confirmation field. Another use case is when you want the user to type in the name of the project or resource before they delete it, sites sometimes block copy and pasting the name to avoid having users get into that h…
That just takes the argument from bad to worse. “How will I condescend to my users without breaking their browser functionality?”
When you have a confirmation field, like signups that require you to type your email and then verify your email, blocking paste stops the user from typing a typo and then copy-pasting the typo into the confirmation field. Another use case is when you want the user to type in the name of the project or resource before they delete it, sites sometimes block copy and pasting the name to avoid having users get into that h…
> When you have a confirmation field, like signups that require you to type your email and then verify your email, blocking paste stops the user from typing a typo and then copy-pasting the typo into the confirmation field. This argument is indefensible. Browsers have had autocomplete for over a decade, Contact book applications that store email addresses have existed over a decade, password managers that also handle…
To be clear, I'm not saying I agree with it. But this isn't a feature for users that have password managers. It's a feature for the staff that handle dozens of calls per week from users complaining they never got the signup email when they had given the wrong email. There's better solutions to that problem though, and like I said I'd be the first to advocate for one. But I can see how it's an easy tool to reach for.
Recently learned that if you Ctrl-F again after the highjacking, it brings up the browser search box.
Discovered this thanks to a site (don't remember which) that included a tooltip about this fact in their hijacked search box. I was curious if it would work on Redocly search, which has no such tooltip, and it did. I'm not positive if this works universally, or is just an undocumented feature of Redocly's interface and won't work in places the developers didn't make specific accommodations for it.
The only one I've ever heard is "security." Sometimes people try to "yeah it's because for security we don't want some tool to paste credentials or clickjacking mumble something malware hacking clipboard spyware javascript browser" but most of the time the truth is "our sec people need to show controls for hardening the authentication process so they came up with that and we just did it because it wasn't worth the fi…
I consider it a reduction in security because it makes entering proper random passwords more difficult - either I have to paste it somewhere else first (and leave it in plaintext on my screen) OR I have to use a more memorable/shorter password. When I can paste passwords, they can be as long as possible and never are actually visible in any way.
Completely agree. There was a particular US government-run website that I had to use that disabled pasting, and required obscenely long passwords (like 15 character minimum, at least two letters/numbers/symbols/capitals/etc), and forced rotation every 60 days, and aggressively blocked "keyboard patterns" and once a password had been used, it couldn't be used again forever. Given I only had to log in about once every 90 days, I literally had to change my password every time. I've never been more enraged at a product in my life. My passwords for that site may have looked good out of context, but in reality I just figured out "keyboard patterns" that it wouldn't detect and used those, and kept the password in plaintext where I could read and type it. It was the biggest security anti-pattern that I could possibly think of.
> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…
It is also not at all clear to me why it "needs to know when you change active tabs".