4 ms·

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo. It used to be true but all that was fixed like 10 years ago.

spideymans 6y ago
I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?
- shakna 6y ago
  Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.
  - gorgoiler 6y ago
    > user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”
    - andy_ppp 6y ago
      This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
  - mavsman 6y ago
    > Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event. Somehow I didn't even realize that's how they were getting around it! I just thought, "Dang, I thought I turned that crap off." Good callout.
- jehna1 6y ago
  The first time you did this your browser asked for a permission via browser's native permission modal
- kalleboo 6y ago
  In Safari you get a browser-provided popup menu that just has "Paste" in it when you click on the Google Docs Paste button, it doesn't paste directly
- saint-loup 6y ago
  In Firefox it doesn't. When you click, a modal panel appears reminding you of the shortcuts.
dylan604 6y ago
Sadly, user interaction does not have to be something done by the user with intent. As another comment below mentions, the code to manipulate the clipboard can be hidden yet still kicked off by the user interacting normally with the website. Don't know about a repo, but https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A...
yreg 6y ago
How is manipulating clipboard not a problem? What if something replaces your fingerprint or bitcoin address?
- Spivak 6y ago
  An app being able to declare some operations to perform on the clipboard (overwrite, append, etc) that don't return any information about the contents are not a problem from a privacy or security perspective. At most they can be annoying.
  - HanayamaTriplet 6y ago
    If your clipboard contents were overwritten with an arbitrary wallet address immediately before you paste into an exchange's "Send BTC to..." field, that would be a pretty big problem. I wouldn't expect that most people would double-check to make sure a series of gibberish characters matches what they expect, especially if they don't have any reason to suspect that paste wouldn't output exactly what they copied a moment ago.

spideymans 6y ago

I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?

shakna 6y ago
Reading from the clipboard is allowed on a user-triggered event. It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event. Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.
- gorgoiler 6y ago
  > user-triggered event “Click Reject All Cookies to exercise your GDPR rights!”
  - andy_ppp 6y ago
    This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.
- mavsman 6y ago
  > Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event. Somehow I didn't even realize that's how they were getting around it! I just thought, "Dang, I thought I turned that crap off." Good callout.
jehna1 6y ago
The first time you did this your browser asked for a permission via browser's native permission modal
kalleboo 6y ago
In Safari you get a browser-provided popup menu that just has "Paste" in it when you click on the Google Docs Paste button, it doesn't paste directly
saint-loup 6y ago
In Firefox it doesn't. When you click, a modal panel appears reminding you of the shortcuts.

dylan604 6y ago

Sadly, user interaction does not have to be something done by the user with intent. As another comment below mentions, the code to manipulate the clipboard can be hidden yet still kicked off by the user interacting normally with the website. Don't know about a repo, but https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A...

yreg 6y ago

How is manipulating clipboard not a problem? What if something replaces your fingerprint or bitcoin address?

Spivak 6y ago
An app being able to declare some operations to perform on the clipboard (overwrite, append, etc) that don't return any information about the contents are not a problem from a privacy or security perspective. At most they can be annoying.
- HanayamaTriplet 6y ago
  If your clipboard contents were overwritten with an arbitrary wallet address immediately before you paste into an exchange's "Send BTC to..." field, that would be a pretty big problem. I wouldn't expect that most people would double-check to make sure a series of gibberish characters matches what they expect, especially if they don't have any reason to suspect that paste wouldn't output exactly what they copied a moment ago.