Live data from Hacker News

LinkedIn is copying the contents of my clipboard on every keystroke

twitter.com

251–260 of 380 posts

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#251

An explanation from LinkedIn: https://twitter.com/eberger45/status/1278843576638570496 ------ Hi @DonCubed . Appreciate you raising this. We've traced this to a code path that only does an equality check between the clipboard contents and the currently typed content in a text box. We don't store or transmit the clipboard contents. ---------- An example of this is in a library we have open sourced, and you can find th…

This should be higher, above all of the mobs teething for vengeance. It’s an innocuous comparison of text input to the pasteboard to prevent unwanted autocorrect insertions.[0] Probably the same code used by TikTok too.

the code and and comments are here: [0] https://github.com/linkedin/Hakawai/pull/162/commits/c3f8958...

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#252

Earlier quoted context omitted.

Thanks for the details. I agree that it’s obnoxious for sites to interfere with copy. But they still can’t read from the clipboard, which is the topic here. And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?

> they still can’t read from the clipboard Incorrect; the API is here [0]. [0]: https://www.w3.org/TR/clipboard-apis/#dom-clipboard-read It is at least supposed to be hidden behind a permission. What's the default for that permission though? I sure hope Google^H^H^H^H^H^HMicrosoft^H^H^H^H^H^H^H^H^Hsome evildoer doesn't find a way to override your permission setting. A reset of configuration data after an automatic up…

Of course there are APIs for accessing the clipboard. I probably use Vim’s clipboard registers 300 times a day. None of this has anything to do with closed source programs reading the clipboard without permission. Speculating that somehow an app might “override your permission setting” is not really informative. There might be any number of exploits.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#253

LinkedIn has a history of acting like a cretin: multiple data breaches, dark patterns where they don't fix their buggy mobile site and just put up a disclaimer "problems with the mobile site - download our app" (just so that they can harvest a wider range of data). I managed many marketing campaigns on Linkedin over the years and spent thousands each month on the platform as a corporate user. If you think that paying…

Their UX dark patterns are incredibly scummy, but I’ve actually found it really useful for quickly reaching the right person for biz dev deals/partnerships.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#254

LinkedIn has a history of acting like a cretin: multiple data breaches, dark patterns where they don't fix their buggy mobile site and just put up a disclaimer "problems with the mobile site - download our app" (just so that they can harvest a wider range of data). I managed many marketing campaigns on Linkedin over the years and spent thousands each month on the platform as a corporate user. If you think that paying…

Not LinkedIn; Microsoft. We should blame the real owner. Maybe they'll pay more attention if these practices become tied to their overall brand.

LinkedIn had dark patterns on day one. Search posts right here on HackersNews. You will see a lot of shady stuff Linkedin was doing in early 2010s.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#255
post #147

Earlier quoted context omitted.

Ugh, I won't use their phone app, they're way too slimy to live there. They conveniently forget your mail settings periodically, too, forcing you to opt-out of various garbage again, or to just trash all the mail. They're at least as scummy as FB, if not worse. My (related) new rule: if your site demands a phone number for an account, I will not create an account on your site.

I’m not a fan of giving phone numbers out either. When I have to I give one to sites I hold suspect I use a number from the safe fictitious range allowed for use on TV and in movies. It’s like example.org but for phone numbers https://en.wikipedia.org/wiki/555_(telephone_number)

I usually look up the company's sales number and give them their own number. I have no idea if this has ever inconvenienced anyone but it does give me a moment of petty satisfaction.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#256
post #247

Earlier quoted context omitted.

And what, exactly, constitutes "direct user request" that both 1) does not break common programming techniques (e.g. an application rolling its own GUI, or implementing its own modes/keybindings) and 2) is not trivially spoofable by the enterprising developer? I understand the outrage over apps abusing their access to the clipboard but what I don't understand is the people acting as though the OSes they use on the da…

> what, exactly, constitutes "direct user request" that both... > 1) does not break common programming techniques (e.g. an application rolling its own GUI, or implementing its own modes/keybindings) A callback method that you can define to do anything you want in your program when the OS hands you the result of a user initiated paste operation because your program had focus. If you want custom keybindings to initiate…

> A callback method that you can define to do anything you want in your program when the OS hands you the result of a user initiated paste operation because your program had focus. If you want custom keybindings to initiate the paste operation, you can register that desire with the OS.

Wonderful! Now how does this brilliant little solution account for applications that don't centre their operations on the keyboard?

How does this work for clicking on a UI element to paste?

How does this work for using non-tactile forms of input - say, a voice command?

How does this work for any method of interaction that's not "press a combination of keys"?

How does this interact with the very real and undebatable need to allow programs to simulate keyboard events?

What happens to operating systems that have the implementation of a system clipboard as out of scope (like a little-known operating system called Linux)? How does, say, the X window server then manage to implement a clipboard on top of it?

> rolling your own GUI and defining keybindings doesn't mean that you control access to the interface. The operating system mediating the hardware does that.

I am very curious indeed: what, exactly, do you think happens when (for example) a C program calls `getchar()`?

> But let's stop making "steal my secrets" part of the fucking standard system API and start working toward a brighter tomorrow.

If you consider something a secret, then may I suggest that you don't (both as a user and as a developer) put it in the general shared buffer for applications? The whole point of a buffer for temporarily storing and transferring data between applications is for said applications to actually access it. You are doing the equivalent of saving your "secret" in plaintext in your home folder and then complaining about the OS if/when a program peeks through your generally accessible home folder and finds it.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#257
post #222

Earlier quoted context omitted.

Skype used to rock before they were acquired

yeah, definitely used to rock when it killed your laptop battery in an hour while running in the background routing other people's calls through you. skype rocked after ms acquired it, fixed these types of problems by providing infrastructure, and it rocked for a decade. it stopped rocking only when they replaced it with the app-looking cut down app, and years later killed the desktop mode program.

I remember as soon as MS switched away from P2P, the latency of my calls went up.

Actually, as far as I can tell every mainstream† voip product right now has more latency than Skype used to. This sucks; it causes conversations to flow less naturally.

† aka not Mumble, which I will never convince friends to use.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#258

Earlier quoted context omitted.

Make clipboard behave like a channel[+], like GNOME native apps do, additionally require a standard paste command to paste, then this clipboard attack will be impossible to conduct. [+]:A sample pipe might be a good analogy for this behaviour. You cut or copy the input, send through the sample pipe, and the receiving end unpacks, receiving itself makes the sample disappear for further use. Multiple samples could be s…

GNOME is based on X11, which _very_ much grants programmatic access to the clipboard to pretty much any application that asks. Seriously, has anyone complaining about this actually paid any attention to how clipboards work on their OSes before this?

> to how clipboards work on their OSes before this?

GNOME has a Wayland implementation too, and what I said only applies to GNOME native apps.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#259

Earlier quoted context omitted.

Not LinkedIn; Microsoft. We should blame the real owner. Maybe they'll pay more attention if these practices become tied to their overall brand.

LinkedIn had dark patterns on day one. Search posts right here on HackersNews. You will see a lot of shady stuff Linkedin was doing in early 2010s.

That's what good culture fit looks like.

Re: LinkedIn is copying the contents of my clipboard on every keystroke

#260

Earlier quoted context omitted.

GNOME is based on X11, which _very_ much grants programmatic access to the clipboard to pretty much any application that asks. Seriously, has anyone complaining about this actually paid any attention to how clipboards work on their OSes before this?

> to how clipboards work on their OSes before this? GNOME has a Wayland implementation too, and what I said only applies to GNOME native apps.

GtkClipboard, like many, many other clipboard implementations, provides programmatic access to applications[0].

I am thus very curious indeed about how a "GNOME native" app differs in this context.

0. https://developer.gnome.org/gtk3/stable/gtk3-Clipboards.html

Post reply on HN