3 ms·
There will always be a way to hide / obfuscate the action, making it seem to the browser that it was user-initiated. I guess Mozilla have weighed up the conven
by joosters 11y ago
There will always be a way to hide / obfuscate the action, making it seem to the browser that it was user-initiated.
I guess Mozilla have weighed up the convenience/security balance of browser control of the clipboard, and have put in a minimal protection scheme to make it clear that code should not play with it behind the user's back, but Mozilla knows that they can't really stop it.
- TazeTSchnitzel 11y ago> There will always be a way to hide / obfuscate the action, making it seem to the browser that it was user-initiated. How? This security mechanism has been used for (among other things) popups for years now, and the only way it's been worked around is by attaching click handlers to links the user is likely to click.
- joosters 11y agoPop ups still occur, even on legitimate sites. Tripadvisor creates a pop-under when you click on a search result, for instance. Basically, the user will click something at some point, the page can then unexpectedly put malicious stuff into the clipboard. No amount of protecting will stop this.
- IshKebab 11y agoThat's exactly what he just said.