341–350 of 397 posts
I use Hammerspoon for Mac, have a shortcut set up for Cmd+Shift+V to actually type the letters rather than use the paste function. Works every time someone pulls this stunt. > hs.hotkey.bind({"cmd", "shift"}, "V", function() hs.eventtap.keyStrokes(hs.pasteboard.getContents()) end)
Earlier quoted context omitted.
Shout out to forms which error out with "Password too long! Must be at most ten characters. All from this subset of ascii". Which seems especially popular with banks.
Yeah, banks unfortunately have their opinionated checklists of “best practices”, also know as “what every other bank does”.
> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…
This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.
To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere. If only I could meet the people who make these decisions in person...
Here was a dumb one from me the other day. - I had to use login.gov - My password manager had a saved login for it, I didn’t remember it, but it worked - Then the site asked me for an authenticator app code. I checked my authenticator apps and there was nothing there for login.gov. - There’s a login another way button so I click that and the other way is use the authenticator app! - I click what if I can’t get my cod…
Earlier quoted context omitted.
Our PCI-compliance audit dings us for not disabling autocomplete on the login form fields. That's not the same as disabling paste, but heading that direction. For personal use I just abandon any site that won't let me use my password manager (Bitwarden).
you just abandon banking websites?
Earlier quoted context omitted.
> Let's put it this way: there have been FLOSS projects whose maintainers intentionally pushed compromised code to unsuspecting end users. See for example the colors attack. Following this logic, we should all stop using any and all software for which we haven't personally inspected the full source code for, since this could happen to any of them.
That's the extreme end, sure. A more reasonable take would be to assess your risk tolerance and the possible benefit for each piece of software you install, and then make the best decision for yourself based on that assessment. For some people, that means not running an extension that provides minor quality of life improvements due to the possibility of it turning malicious further down the road. For other people, it…
Earlier quoted context omitted.
But WHY do they need that permission? They dont need it to implement the paste behavior. Looks super sus to me.
The extension needs to re-enable paste, which means it needs to possibly inject some JS into the page.
One doesn't need broad security permissions.
I use Hammerspoon for Mac, have a shortcut set up for Cmd+Shift+V to actually type the letters rather than use the paste function. Works every time someone pulls this stunt. > hs.hotkey.bind({"cmd", "shift"}, "V", function() hs.eventtap.keyStrokes(hs.pasteboard.getContents()) end)
Earlier quoted context omitted.
That's the extreme end, sure. A more reasonable take would be to assess your risk tolerance and the possible benefit for each piece of software you install, and then make the best decision for yourself based on that assessment. For some people, that means not running an extension that provides minor quality of life improvements due to the possibility of it turning malicious further down the road. For other people, it…
If you personally think extensions are too much of a security risk for you, sure, don't use them. But please don't comment "ackshually extensions are insecure and using them is a bad idea" on every post about a browser extension. We already know the risks, it's explained when you install them, we don't need to hear the same lecture every day.
I haven't? My first comment on this entire topic is the one you are replying to... And it can be summed up as "risk tolerance and security decisions is personal".
Yikes.