5 ms·

I find the reasons not to mitigate this in any way short-sighted. Disabling the copying of invisible text will not mitigate all the instances. Disabling the mo

I find the reasons not to mitigate this in any way short-sighted. Disabling the copying of invisible text will not mitigate all the instances. Disabling the modification via clipboard events won't either. Nor will disabling the ability to see user's selection. But each of them would cut off a lot of offenders already (defense in depth-like), and each change in this direction would give credibility to the idea that the expected behaviour is to copy what's visible. With all of them implemented, it would become politically much more palatable to plug the last holes and let copy-paste behave 100% as users expect.

ArchReaper 7y ago
I think your suggestion would actually make things worse, because it would cause more people to have a false sense of security when copying from a web browser, which is exactly the problem in the first place. The issue is not that the clipboard can be modified. The issue is that users expect a clean copy when they copy from a website. There are many valid uses for this, and there is not a strong enough argument that this presents a real security issue that would necessitate disabling such a widely-used feature.
- rhn_mk1 7y ago
  I don't think security is the only factor here. Security is only achieved when 100% of the holes are plugged, which is indeed not achievable outright. But what is achievable immediately is being closer to user's expectations of what will be pasted in general, and a step-by-step approach gives benefits in this regard at every step, without making false promises.
  - ArchReaper 7y ago
    Ok. So you're editing a sheet on google docs, you highlight part of it to copy into another doc. You hit ctrl+c. What happens? Do we not let Google modify what you just copied to inject the actual rich-text version of what you highlighted, as opposed to the presentation-formatted version you're seeing as a user in the editor UI? What can actually be done if we allow the 'good actors' to continue working as needed?
    - pavel_lishin 7y ago
      Let's handle this like we handle things like location tracking, notifications, etc: ask the user. Except I don't think we should ask the user, because everyone will blindly click yes. I think we should disable this by default, and let Google Docs, etc., remind the user via some in-app modal with step-by-step instructions. If someone actually needs this functionality, let them do the work to unlock it for a given website. 99.99999% of the web has no good reason to be modifying a user's clipboard.
      - ArchReaper 7y ago
        I encourage you to read through the OP first on why your suggestion (remove copy-modification entirely) is not reasonable.
        pavel_lishin 7y ago
        Ah: > The metro.co.uk code inserts an off-screen-positioned element with the disclaimer into the selection range, and you could just listen for selectionchange and/or mouse drag and/or keypress events to detect selection changes, and add/remove such an element based on those events. Well, shit.
        roywiggins 7y ago
        My favorite scummy thing done to mess with browsers is to insert a noscript meta refresh redirect just to catch anyone who refuses to run the JavaScript adware embedded in their crappy local news website CMS. It must be standard in some local newspaper CMS and I've only ever seen it used on that sort of site. Never underestimate newspaper publishers' CMS vendors' ingenuity.
    - weaksauce 7y ago
      > Do we not let Google modify what you just copied to inject the actual rich-text version of what you highlighted, as opposed to the presentation-formatted version you're seeing as a user in the editor UI? could you not have a two tiered clipboard that is exposed via javascript for the webpage interactions(to solve the copy and paste issue with rich text inside google docs) but have the main paste system be synced with the system clipboard and that restricts the copy and paste to visible text/non-javascript hijackable(stops the manipulation of the clipboard to inject malicious code for terminals or even the annoying injection of "this snippet was copied from example.com/xyz") I haven't thought too hard about the downsides to this or how hard it would be to implement but i'd be curious to see any discussion on some kind of approach like this.
- komali2 7y ago
  Isn't this just a rehash of the "people ride their bicycle more dangerously when they're wearing helmets" argument? The solution is all of the above, and also don't paste stuff into your terminal from the internet.
  - lillesvin 7y ago
    > also don't paste stuff into your terminal from the internet. Or at least use a shell or terminal that handles pasted newlines gracefully.
    - btschaegg 7y ago
      …or use bash's `edit-and-execute-command` feature (`C-x C-e` or `ESC v` in vi mode).
- deleted 7y ago
  [deleted]
- uneekname 7y ago
  I respect and share your goal to educate users about what they should expect from their browser/computer security-wise. As someone with a (healthy?) distrust of the content I copy/paste, and would never run code I copy/pasted without checking it first (one of the examples given in the linked bug report thread), I would still rather my browser only copy the text that I visibly highlighted. It is annoying to edit content out that I have carefully selected.
  - ArchReaper 7y ago
    >I would still rather my browser only copy the text that I visibly highlighted. It is annoying to edit content out that I have carefully selected. Absolutely. But how do we solve that problem and still allow proper usage of it? Removing this feature would break the copy ability of nearly every rich-text-like web-based UI in existence, such as Google Sheets. Personally, this feels more like something for an adblock-like addon.
    - NoodleIncident 7y ago
      The 10 sites that have a genuine reason to listen to selection events and force you to copy invisible text can ask permission to do so, as suggested in the thread.
      - ArchReaper 7y ago
        That still does not answer the question of "what are we asking permission for?" Why that is a hard question can be understood by reading through the discussions in the OP.
    - Marsymars 7y ago
      > Removing this feature would break the copy ability of nearly every rich-text-like web-based UI in existence, such as Google Sheets. Skipping over the technical implementation issues, I'd rather copying rich-text-like be relegated to a "Copy Rich Content" context menu action, and the default copy command be plain text only. I very seldom want to copy rich content. I very frequently am copy/pasting content to notepad, selecting it, and then copying it again in order to strip out the rich content I don't want.
Someone1234 7y ago
I'd agree with you if the proposed fixes were "freebies." But they're not, far from it. Each proposed fix breaks a substantial number of websites, and you're breaking tons of websites for something you know can be trivially bypassed from the get-go. There's certain times/reasons to break a tons of sites. SameSite being one of them. Mandating Https across resources was another. This group of hacks that don't really fix the core issue, is definitely not one of those times. If someone can legit fix it, it might be worth some breakage, but the fix has to be far better than the proposals here (and to be honest I don't think it is actually possible to fix, a simple font can undo any amount of work).
- yellowapple 7y ago
  > Each proposed fix breaks a substantial number of websites, and you're breaking tons of websites for something you know can be trivially bypassed from the get-go. Which websites? Do you have specific examples? If your website functionality is critically dependent on manipulating my clipboard in ways I can neither predict nor expect, then I'd argue your website is broken by design and should be burned to the ground and rebuilt from scratch. The only legitimate use of this I can think of is a "click here to copy this text to your clipboard" type of button, and I'd hardly count that as a critical feature (hell, more often than not it just gets in the way).
  - Someone1234 7y ago
    > Which websites? Do you have specific examples? The link contains specific examples. But Microsoft's entire suite of Office 365 online applications is another example. > critically dependent on manipulating my clipboard They're manipulating their own content before populating your clipboard request. There's a stark difference. If you turn off the clipboard interception (there's several extensions that do just that) you'll often get garbage out instead (e.g. raw HTML, gibberish, etc). But don't take my word for this, install one of those extensions and never opt out of any sites. You'll get roughly the experience you're asking for, including the broken ones.
    - 7y ago

ArchReaper 7y ago

I think your suggestion would actually make things worse, because it would cause more people to have a false sense of security when copying from a web browser, which is exactly the problem in the first place. The issue is not that the clipboard can be modified. The issue is that users expect a clean copy when they copy from a website. There are many valid uses for this, and there is not a strong enough argument that this presents a real security issue that would necessitate disabling such a widely-used feature.

rhn_mk1 7y ago
I don't think security is the only factor here. Security is only achieved when 100% of the holes are plugged, which is indeed not achievable outright. But what is achievable immediately is being closer to user's expectations of what will be pasted in general, and a step-by-step approach gives benefits in this regard at every step, without making false promises.
- ArchReaper 7y ago
  Ok. So you're editing a sheet on google docs, you highlight part of it to copy into another doc. You hit ctrl+c. What happens? Do we not let Google modify what you just copied to inject the actual rich-text version of what you highlighted, as opposed to the presentation-formatted version you're seeing as a user in the editor UI? What can actually be done if we allow the 'good actors' to continue working as needed?
  - pavel_lishin 7y ago
    Let's handle this like we handle things like location tracking, notifications, etc: ask the user. Except I don't think we should ask the user, because everyone will blindly click yes. I think we should disable this by default, and let Google Docs, etc., remind the user via some in-app modal with step-by-step instructions. If someone actually needs this functionality, let them do the work to unlock it for a given website. 99.99999% of the web has no good reason to be modifying a user's clipboard.
    - ArchReaper 7y ago
      I encourage you to read through the OP first on why your suggestion (remove copy-modification entirely) is not reasonable.
      - pavel_lishin 7y ago
        Ah: > The metro.co.uk code inserts an off-screen-positioned element with the disclaimer into the selection range, and you could just listen for selectionchange and/or mouse drag and/or keypress events to detect selection changes, and add/remove such an element based on those events. Well, shit.
        roywiggins 7y ago
        My favorite scummy thing done to mess with browsers is to insert a noscript meta refresh redirect just to catch anyone who refuses to run the JavaScript adware embedded in their crappy local news website CMS. It must be standard in some local newspaper CMS and I've only ever seen it used on that sort of site. Never underestimate newspaper publishers' CMS vendors' ingenuity.
  - weaksauce 7y ago
    > Do we not let Google modify what you just copied to inject the actual rich-text version of what you highlighted, as opposed to the presentation-formatted version you're seeing as a user in the editor UI? could you not have a two tiered clipboard that is exposed via javascript for the webpage interactions(to solve the copy and paste issue with rich text inside google docs) but have the main paste system be synced with the system clipboard and that restricts the copy and paste to visible text/non-javascript hijackable(stops the manipulation of the clipboard to inject malicious code for terminals or even the annoying injection of "this snippet was copied from example.com/xyz") I haven't thought too hard about the downsides to this or how hard it would be to implement but i'd be curious to see any discussion on some kind of approach like this.
komali2 7y ago
Isn't this just a rehash of the "people ride their bicycle more dangerously when they're wearing helmets" argument? The solution is all of the above, and also don't paste stuff into your terminal from the internet.
- lillesvin 7y ago
  > also don't paste stuff into your terminal from the internet. Or at least use a shell or terminal that handles pasted newlines gracefully.
  - btschaegg 7y ago
    …or use bash's `edit-and-execute-command` feature (`C-x C-e` or `ESC v` in vi mode).
deleted 7y ago
[deleted]
uneekname 7y ago
I respect and share your goal to educate users about what they should expect from their browser/computer security-wise. As someone with a (healthy?) distrust of the content I copy/paste, and would never run code I copy/pasted without checking it first (one of the examples given in the linked bug report thread), I would still rather my browser only copy the text that I visibly highlighted. It is annoying to edit content out that I have carefully selected.
- ArchReaper 7y ago
  >I would still rather my browser only copy the text that I visibly highlighted. It is annoying to edit content out that I have carefully selected. Absolutely. But how do we solve that problem and still allow proper usage of it? Removing this feature would break the copy ability of nearly every rich-text-like web-based UI in existence, such as Google Sheets. Personally, this feels more like something for an adblock-like addon.
  - NoodleIncident 7y ago
    The 10 sites that have a genuine reason to listen to selection events and force you to copy invisible text can ask permission to do so, as suggested in the thread.
    - ArchReaper 7y ago
      That still does not answer the question of "what are we asking permission for?" Why that is a hard question can be understood by reading through the discussions in the OP.
  - Marsymars 7y ago
    > Removing this feature would break the copy ability of nearly every rich-text-like web-based UI in existence, such as Google Sheets. Skipping over the technical implementation issues, I'd rather copying rich-text-like be relegated to a "Copy Rich Content" context menu action, and the default copy command be plain text only. I very seldom want to copy rich content. I very frequently am copy/pasting content to notepad, selecting it, and then copying it again in order to strip out the rich content I don't want.

Someone1234 7y ago

I'd agree with you if the proposed fixes were "freebies." But they're not, far from it. Each proposed fix breaks a substantial number of websites, and you're breaking tons of websites for something you know can be trivially bypassed from the get-go. There's certain times/reasons to break a tons of sites. SameSite being one of them. Mandating Https across resources was another. This group of hacks that don't really fix the core issue, is definitely not one of those times. If someone can legit fix it, it might be worth some breakage, but the fix has to be far better than the proposals here (and to be honest I don't think it is actually possible to fix, a simple font can undo any amount of work).

yellowapple 7y ago
> Each proposed fix breaks a substantial number of websites, and you're breaking tons of websites for something you know can be trivially bypassed from the get-go. Which websites? Do you have specific examples? If your website functionality is critically dependent on manipulating my clipboard in ways I can neither predict nor expect, then I'd argue your website is broken by design and should be burned to the ground and rebuilt from scratch. The only legitimate use of this I can think of is a "click here to copy this text to your clipboard" type of button, and I'd hardly count that as a critical feature (hell, more often than not it just gets in the way).
- Someone1234 7y ago
  > Which websites? Do you have specific examples? The link contains specific examples. But Microsoft's entire suite of Office 365 online applications is another example. > critically dependent on manipulating my clipboard They're manipulating their own content before populating your clipboard request. There's a stark difference. If you turn off the clipboard interception (there's several extensions that do just that) you'll often get garbage out instead (e.g. raw HTML, gibberish, etc). But don't take my word for this, install one of those extensions and never opt out of any sites. You'll get roughly the experience you're asking for, including the broken ones.
  - 7y ago