Every day I read about another outrage being committed by another garbage app that I do not have and would never install on my phone. Why do people need a LinkedIn app? Even if you think that you need LinkedIn, can’t you access your please-spam-me account through your browser? Isn’t it obvious that every closed-source mystery program that you install increases your attack surface? You wouldn't click on an email attachment from a stranger in Russia, so why install an executable from a company that you already know is unethical?
LinkedIn is copying the contents of my clipboard on every keystroke
31–40 of 380 posts
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#32is there any company we can still trust?
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#33Earlier quoted context omitted.
A few years ago, linkedin purposefully changed their notification emails to have less information so you're forced to log in and read the notification on their platform. Linkedin is also widely known for when they scraped users contacts and then spammed them. Call it incompetence if you want, but there's a certain flavor of evil incompetence here.
Facebook (including Messenger) does it too. There might be a thin guise of "security" (i.e. email isn't a secure place to send your top-secret inbound message) but I'm inclined to suspect the main motivation is to drive people back to the platform and drive up their stickiness metrics. It's user-hostile.
It is not just Facebook and LinkedIn. I've seen this from random small sites.
Some other silly shit that come to mind - having the unsubscribe link after half/full page of white space, once you click on unsubscribe "give us 24 to 48 hours to remove your email" etc. Really? they need 24 hours to delete (or change a flag) in the database?
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#34One of my hobbies is looking at url strings with GET key/value pairs. Programmers must forget that they're visible to users. LinkedIn has a search workflow that shows "origin=TYPEAHEAD_ESCAPE_HATCH" which I've always found humorous.
> Programmers must forget that they're visible to users.
GET parameters aren't usually visible to users; with the deemphasis of the URL bar, you'd have to have an incredibly short URL for that to even be a possbility. Right now I'm looking at
https://news.ycombinator.com/reply?id=23717577&goto=item%3Fi .......
In the larger sense, where users can see the parameters if they intentionally look for them, despite the fact that they are normally invisible, POST parameters are just as visible.
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#35Every day I read about another outrage being committed by another garbage app that I do not have and would never install on my phone. Why do people need a LinkedIn app? Even if you think that you need LinkedIn, can’t you access your please-spam-me account through your browser? Isn’t it obvious that every closed-source mystery program that you install increases your attack surface? You wouldn't click on an email attac…
Think it's just the app? Hope you don't have your clipboard events enabled in your browser
Edit for those interested:
tl;dr: "asynchronous clipboard API" [0]
Overtly, it's used by shit news sites like WSJ, nytimes, and bloomberg to inject their shit into your clipboard when you copy-paste. A common thing I've noticed is selecting text, copying the text, and then pasting somewhere and seeing a link to the original article instead.
I'm not sure if they're still doing it; there has been several people complaining about this over time [1] [2] [3] [4] [5] [6]. I found this awesome article on the Security StackExchange from 2013 [8].
Also it's not just javascript. You might be forgiven to think that using a command-line interface would spare you. Unfortunately you'd be wrong; mosh, tmux, vi, emacs all support your terminal emulator's clipboard events. [7] [8]
[0]: https://www.w3.org/TR/clipboard-apis/
[1]: 4 months ago: https://news.ycombinator.com/item?id=22352674
[2]: 4 months ago: https://news.ycombinator.com/item?id=22446940
[3]: 8 months ago: https://news.ycombinator.com/item?id=21377598
[4]: March 2019: https://news.ycombinator.com/item?id=19384895
[5]: December 2017: https://news.ycombinator.com/item?id=16034854
[6]: September 2015: https://news.ycombinator.com/item?id=10301881
[7]: Three months ago: https://news.ycombinator.com/item?id=22815757
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#36One of my hobbies is looking at url strings with GET key/value pairs. Programmers must forget that they're visible to users. LinkedIn has a search workflow that shows "origin=TYPEAHEAD_ESCAPE_HATCH" which I've always found humorous.
Yeah I noticed that too. If you go to the profile page of someone who has the LinkedIn pro version and hover over the gold "in" symbol next to their name, it links to a URL containing
upsellOrderOrigin=premium_badge_profile_upsellRe: LinkedIn is copying the contents of my clipboard on every keystroke
#37Guess I'm never copying and pasting anything sensitive on my phone ever again. Still don't understand why clipboard-sniffing isn't behind a permissions flag.
Well, once upon a time you trusted the code running on your device. In Chrome on Android, the flag you want is under Settings | Site Settings | Clipboard | Ask before allowing sites to read text and images from the clipboard , and I think it's on by default.
The question is, does Android itself have that flag?
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#38Does this recurring problem suggest a missing API?
Make clipboard behave like a channel[+], like GNOME native apps do, additionally require a standard paste command to paste, then this clipboard attack will be impossible to conduct.
[+]:A sample pipe might be a good analogy for this behaviour. You cut or copy the input, send through the sample pipe, and the receiving end unpacks, receiving itself makes the sample disappear for further use. Multiple samples could be sent through the pipe, though the pipe should behave in a LIFO, no sample adding allowed after removal starts, manner if this is desired.
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#39Why does a website or app even need access to the clipboard? I would maybe naively think that the OS could send the characters on the clipboard as if they were typed quickly, end of story.
Re: LinkedIn is copying the contents of my clipboard on every keystroke
#40Every day I read about another outrage being committed by another garbage app that I do not have and would never install on my phone. Why do people need a LinkedIn app? Even if you think that you need LinkedIn, can’t you access your please-spam-me account through your browser? Isn’t it obvious that every closed-source mystery program that you install increases your attack surface? You wouldn't click on an email attac…
Yeah, but companies are more competent than government and that's what matters
https://news.ycombinator.com/item?id=23716931
right?