Live data from Hacker News

Don't fuck with paste

github.com

51–60 of 397 posts

Re: Don't fuck with paste

#51

Earlier quoted context omitted.

I honestly didn't know about Ctrl-G. You my have significantly changed my life!

isn't ctrl-g common for "find next" with shift-ctrl-g "find previous"? maybe i live too much in my IDE/text editors?

On macOS cmd+g is a standard shortcut most apps implement.

Re: Don't fuck with paste

#52
To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least.

Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere.

If only I could meet the people who make these decisions in person...

Re: Don't fuck with paste

#53
post #3

Ya, fucking with paste is a pet peeve of mine. What's a good argument for fucking with paste?

The only one I've ever heard is "security." Sometimes people try to "yeah it's because for security we don't want some tool to paste credentials or clickjacking mumble something malware hacking clipboard spyware javascript browser" but most of the time the truth is "our sec people need to show controls for hardening the authentication process so they came up with that and we just did it because it wasn't worth the fi…

That’s exactly what I’ve heard. In a discussion about this recently at my job they wanted to add this to some login related forms.

I pointed out this was obnoxious and I’ve heard in the past copy & paste can be important for accessibility though I can’t be sure first hand.

Security BS was the reason I was given.

The irony is our IT department tells us to use a specific password manager and copy & paste usernames and complex passwords because the app doesn’t have browser integration. I assume “for security”.

Re: Don't fuck with paste

#54
post #10

Earlier quoted context omitted.

seems like an unmaintained fork of the less provocative, https://github.com/jswanner/DontF-WithPaste

I mean it doesn’t really offend me but it would be difficult to say recommend it to my mom. I guess it’s just me.

It’s not just you. You summarized my own feelings quite nicely: it doesn’t bother me a bit, but I wouldn’t recommend it outside informal circles.

Re: Don't fuck with paste

#55
For something simple like this that doesn't really need to be on all the time I've started leaning back towards bookmarklets over extensions. The code is usually simple enough to actually audit, it only runs when you click the bookmarklet, and it doesn't update underneath you without warning.

A few months back someone shared several bookmarklets that they use, one of which was a simple one that disables all clipboard events on the open tab:

https://news.ycombinator.com/item?id=38014653

Re: Don't fuck with paste

#56
There is one thing I hate more. Its having my cursor moved to another application as I am typing out a password in a field. I've literally had to change a password after it suddenly got sent out in a google search when I wasn't paying attention.

Re: Don't fuck with paste

#57

You shouldn't need to trust an addon for this, it's something you should be able to set in the browser. In firefox you can toggle dom.event.clipboardevents.enabled

I wish I could selectively disable only the "paste" events, because it's extremely useful to have "click to copy this value" type of buttons in our various work tools, and I miss the ability to do that every time I try turning off clipboard events to deal with bad actors.

Re: Don't fuck with paste

#58

Earlier quoted context omitted.

I consider it a reduction in security because it makes entering proper random passwords more difficult - either I have to paste it somewhere else first (and leave it in plaintext on my screen) OR I have to use a more memorable/shorter password. When I can paste passwords, they can be as long as possible and never are actually visible in any way.

Completely agree. There was a particular US government-run website that I had to use that disabled pasting, and required obscenely long passwords (like 15 character minimum, at least two letters/numbers/symbols/capitals/etc), and forced rotation every 60 days, and aggressively blocked "keyboard patterns" and once a password had been used, it couldn't be used again forever. Given I only had to log in about once every…

They finally fixed it after years of griping (I assume because the skyrocketing interest rates meant a large number of people suddenly began using it), but for a long time the official website for buying US government bonds wouldn't let you use your keyboard at all to enter your password, you had to click on an on-screen keyboard Java applet. For "security". Fortunately most password manager tools could break through it and paste into the password field anyway, but what a fuckup that was.

(And the site still sucks- you can't use the back button at all, for example-- but it sucks infinitesimally less now)

Re: Don't fuck with paste

#59

Earlier quoted context omitted.

I honestly didn't know about Ctrl-G. You my have significantly changed my life!

isn't ctrl-g common for "find next" with shift-ctrl-g "find previous"? maybe i live too much in my IDE/text editors?

Almost certainly, but It's one of of these "I can't believe I never knew this, it's so obvious!" things.

Re: Don't fuck with paste

#60

This was one of those things that frustrated me so much that we ended building this natively into Orion browser (Tools menu -> Allow Copy & Paste). [1] One of the joys of building your own browser. [1] https://kagi.com/orion

How would you rate the security posture of Orion compared to Chrome?
Post reply on HN