Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Copy-Paste from Website to Terminal

thejh.net

Post reply on HN
Print view View original

61–70 of 272 posts

Re: Don't Copy-Paste from Website to Terminal

#61

Post by pekk »

eli wrote: post #20
cmsj wrote: post #14

Earlier quoted context omitted.

I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer…

That's a pretty narrow view. Sometimes I want a site to capture selections or right-click (think: WYSIWYG editor widget). Your beef is with the site owners who put that obnoxious stuff on their site, not with the browser that displays it. There is no limit to the number of ways a site owner can do dumb and annoying things to their readers.

Since site owners are often not trustworthy on petty issues like this, it would be nice if browsers would make an effort to protect from the more obvious forms of malice rather than telling the user that it's their fault if anything happens

Re: Don't Copy-Paste from Website to Terminal

#63

Post by Tyr42 »

Actually, since I tried to copy it by triple clicking, which selects one line (at least, I expect it to. It's what sublime text does). That didn't copy any of the malicious text, and it just stopped between the clone and the url.

Re: Don't Copy-Paste from Website to Terminal

#64

Post by bluetooth »

icebraining wrote: post #56
bluetooth wrote: post #18

This is really just an extension of clickjacking - modifying the UI to trick the user into performing an undesired action. This is a pretty novel idea, and considering how many websites make use of this to slap their permalinks into copied text (albeit with flash, usually), I'm surprised this hasn't been thought of before. It would be an interesting experiment to sneak a harmless command after every snippet on a site…

Even if the shell had such protection, they could just do 'evil command && visible command'.

Good point.

Re: Don't Copy-Paste from Website to Terminal

#65

Post by crazygringo »

jiggy2011 wrote: post #50
SG- wrote: post #43

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden.

But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this.

So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way around it.

Re: Don't Copy-Paste from Website to Terminal

#66

Post by pekk »

jiggy2011 wrote: post #50
SG- wrote: post #43

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

The browser knows that the text is not visible, because it is the browser which is not displaying it. Yet the browser is choosing to include it in the copy. Why?

Re: Don't Copy-Paste from Website to Terminal

#67

Post by julian37 »

jiggy2011 wrote: post #50
SG- wrote: post #43

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

In this particular case, the characters that get copied are clearly rendered far outside of the area selected by the mouse (in fact, outside the visible area), so I don't see a reason why the browser should think I meant to copy them.

Yes, it's probably not easy to fix, and once fixed there are probably a dozen different ways of cheating. I'm just pointing out that it's certainly possible to fix this particular attack vector.

Re: Don't Copy-Paste from Website to Terminal

#68

Post by Bootvis »

hluska wrote: post #58
dechols wrote: post #13

So the answer is to paste it into an editor first?

Or alternately, the solution is to paste it into your terminal, then take the time to read over what you pasted and make sure you understand what is going to happen before you hit enter. This is doubly important if the first word is 'sudo'!! Not only is this a good habit as far as security goes, it's also the best way I can think of to learn from problems.

If the text contains a newline the command[1] will be executed immediately so that won't protect you.

[1]: At least, in the terminals I regularly use.

Re: Don't Copy-Paste from Website to Terminal

#69

Post by eropple »

hluska wrote: post #58
dechols wrote: post #13

So the answer is to paste it into an editor first?

Or alternately, the solution is to paste it into your terminal, then take the time to read over what you pasted and make sure you understand what is going to happen before you hit enter. This is doubly important if the first word is 'sudo'!! Not only is this a good habit as far as security goes, it's also the best way I can think of to learn from problems.

This isn't a solution--this is exactly the dangerous behavior that this webpage is trying to convince you not to do.

Because they can put a newline in the malicious paste.

Re: Don't Copy-Paste from Website to Terminal

#70

Post by hollerith »

jiggy2011 wrote: post #57
hollerith wrote: post #37

Earlier quoted context omitted.

Valid point. " Design -delivery platform", then. My big point is that this is one of the many ways that the ambitious goals of the browser makers and authors of web standards screw up the workflows of those trying to use the web for reading and "allied activites" like navigating, scrolling and cutting and pasting. These ambitious goals include assisting app developers and assisting design professionals (design profes…

The reason that the web is popular is because it supports these features for design-delivery and application delivery. You could probably implement an online text reading system with basic markup and hyperlinks over a weekend, but the problem would be that nobody would use it because it would be seen as strictly inferior to the web.

I hope you are not setting up a false dichotomy in your mind between the web as it is now and an online text-reading system with no design touches.

I would want this "text-reading system" for example to have something like CSS. The difference would be that instead of creating ever-more powerful versions of CSS and Javascript, the architects and implementors of the text-reading system would pay attention to gotchas like the gotcha described in the OP (changing browsers so that what is copied into the clipboard is exactly the visible text the user has highlighted).

Post reply on HN