Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the clipboard works

whynothugo.nl

Post reply on HN
Print view View original

81–90 of 160 posts

Re: How the clipboard works

#81

Post by nirimda »

imiric wrote: post #53
HPsquared wrote: post #36

Earlier quoted context omitted.

Drag-and-drop works pretty nicely with most password managers, avoiding the clipboard (in Windows at least). In Android, it's a case of using a password manager with a built-in keyboard, and having a button available to switch keyboards quickly.

I think those are workarounds with questionable UX. Whereas something as security sensitive as credential access should have a native OS-provided workflow that's secure by default.

Drag-and-drop seems to have an excellent UX. The semantics are incredibly clear: Take this data from this app and put them into this container in that app. Any insecurities would be an accident of implementation rather than part of the core design like with copy-paste.

Or, how is drag-and-drop insecure by default, and what alternative do you propose?

Re: How the clipboard works

#82

Post by School-Cotton »

dfox wrote: post #59
the_mitsuhiko wrote: post #22

Earlier quoted context omitted.

> It's interesting to look at these clipboard APIs together to see what may have led to the Wayland design If that lead to Wayland then I think people took away the wrong lessons. Wayland's current protocol / API for clipboards is incredibly annoying. It's hard to deal with for applications, it's even harder to deal with for clipboard managers which were not really considered in that design and usually break the clip…

X11/ICCCM clipboard semantics (which is arguably the same design, but with the server being part of the data transfer) was also source of many bugs and the applications/toolkits did not get it right until 00's and linux-centric desktop environments. IIRC disagreement about how to integrate Emacs' concept of kill rings with X11 selections was one of the major reasons for Emacs/XEmacs split.

> the applications/toolkits did not get it right until 00's

They have still not gotten it right. I still sometimes experience the clipboard losing things on modern Ubuntu.

Re: How the clipboard works

#83

Post by the_mitsuhiko »

aumerle wrote: post #80
the_mitsuhiko wrote: post #22

Earlier quoted context omitted.

> It's interesting to look at these clipboard APIs together to see what may have led to the Wayland design If that lead to Wayland then I think people took away the wrong lessons. Wayland's current protocol / API for clipboards is incredibly annoying. It's hard to deal with for applications, it's even harder to deal with for clipboard managers which were not really considered in that design and usually break the clip…

That's generally true of most things in Wayland. It's poorly designed and then badly implemented, by multiple different compositors in different ways, leading to endless bug reports and broken software.

What's so frustrating is that this is my Linux desktop experience since I have been using it. Clipboards not surviving shutdown where at one point not working, then a bunch of people got together to fix it up and now it's broken again. My Wayland experience is a massive flashback to 2004.

Re: How the clipboard works

#84

Post by 323 »

imiric wrote: post #33

It's remarkable to me how we still don't have a security-minded clipboard implementation, seemingly on any OS. It's standard security practice now to use a password manager, but they all[1] exchange critically sensitive data with applications via the clipboard, which is accessible by any application that asks for it. The best we can do is automatically clear the clipboard after a certain time, but this still leaves a…

> which is accessible by any application that asks for it

If you have malicious software running on your system, all bets are off. There are many ways it could steal your passwords, since desktop OSes don't sandbox apps like mobile OSes do.

Just one example: you send the password securely to Chrome, but the malicious app just reads the login session cookie from the Chrome user profile files.

Having a secure way of sending a password to an app would indeed be a defense in depth, but fundamentally the system is broken since all apps run with the same permission as the user, thus they can interfere with each other.

Re: How the clipboard works

#85

Post by SeanLuke »

jeroenhd wrote: post #17

For those wondering about how Windows does this, there is, as you'd expect, a Raymond Chen article about it: https://devblogs.microsoft.com/oldnewthing/20210526-00/?p=10... (and some more, like https://devblogs.microsoft.com/oldnewthing/20220608-00/?p=10... ) Elsewhere in these comments there is also a link to an explainer for the macOS equivalent. Here's also an explainer for X11: https://www.uninformativ.de/blog/po…

> Elsewhere in these comments there is also a link to an explainer for the macOS equivalent.

I know you didn't mean anything by this, but given that the entire concept of a clipboard was invented by the Mac/Lisa team (the Xerox Alto didn't have one), it seems wrong to describe it as an "equivalent" to Windows.

Re: How the clipboard works

#86

Post by 323 »

Beltalowda wrote: post #47
imiric wrote: post #33

It's remarkable to me how we still don't have a security-minded clipboard implementation, seemingly on any OS. It's standard security practice now to use a password manager, but they all[1] exchange critically sensitive data with applications via the clipboard, which is accessible by any application that asks for it. The best we can do is automatically clear the clipboard after a certain time, but this still leaves a…

Are there "clipboard snoopers" out there? Or more specifically, are there clipboard snoopers that access sensitive data they couldn't also access in any other way? It seems to me that if you can access the system clipboard you have enough access to do all sorts of stuff.

There are known cases of malware clipboard snoopers which replaced bitcoin addresses with attacker controlled ones, so if you copy/pasted an address to send bitcoin to, you would end up sending it to the attacker.

https://techcrunch.com/2018/07/03/new-malware-highjacks-your...

Re: How the clipboard works

#87

Post by [deleted] »

Beltalowda wrote: post #45
Daub wrote: post #8

My life was significantly improved when I discovered control shift paste, which pastes just text without format. But un-desired formatting of text remain the bane of my life.

GitHub started mangling text some months ago and it bugs the hell out of me. It's also completely unnecessary as GitHub already links things like @user, #123, and deadbeef (for commit hashes). I just want to copy the exact literal text I see; why does that need to be hard? You can set "dom.event.clipboardevents.enabled" in Firefox to disable all of that, but some websites can break horribly because they just assume i…

[deleted]

Re: How the clipboard works

#88

Post by wongarsu »

TuringTest wrote: post #2

> The majority of the implementations out there are broken and only handle text. Copy/paste are the biggest neglected operations in computing, considering that they are the only universal mechanism for transferring data between applications that is accessible to end users. Mobile intents do help somehow, but they are not universal or available on desktop or web environments.

In Windows-land I'm more annoyed that lots of applications default to pasting rich-text, when in 95% of cases I only want the text and not the formatting.

Otoh, copy-pasting images or entire files works great, as does drag-and-drop all over the place (dragging things from Firefox's download popup, or from E-Mail attachments).

Re: How the clipboard works

#89

Post by ffpip »

Vinnl wrote: post #50
Daub wrote: post #8

My life was significantly improved when I discovered control shift paste, which pastes just text without format. But un-desired formatting of text remain the bane of my life.

Off-topic, but a somewhat similar experience for me was learning about Alt+select. Allows you to select parts of a hyperlink without actually activating the link. (At least in Firefox.) When you first hear about it, you think "What's the big deal?", but then you quickly find that you use it pretty often.

Thank you! Did not know about Alt+select in Firefox.

Re: How the clipboard works

#90

Post by jdsnape »

Beltalowda wrote: post #75
jdsnape wrote: post #69

Earlier quoted context omitted.

Yes - for example https://github.com/slyd0g/SharpClipboard This is designed to work with CobaltStrike, which is a tool used by security testers (i.e. redteams), but also by real life adversaries as well.

So has anyone every used that as an attack vector? Some proof-of-concept code is not hard to write.

yes - see https://attack.mitre.org/techniques/T1115/ for a non-exhaustive list
Post reply on HN