3 ms·

> I literally implemented support for the navigator.clipboard.write API I beg you, do not let websites put things into my clipboard.

IvanK_net 6y ago
It can be done only after the user confirms, that they want to allow the website to do it (similar to a webcam access, etc).
- account42 6y ago
  Is there also an option to never show that popup for any website?
  - IvanK_net 6y ago
    This is up to a browser. I believe a browser should give you an option to decline all such requests by default, without asking you each time. Just like you can browse the web with JS disabled, without images, etc.
DyslexicAtheist 6y ago
if this is important to some users (to me it is) why blindly trust an application's claim of what it does without verifying/restricting it[1]? The IMHO logical step for a user (again most don't care) would be to sandbox the application with a precise set of calls that are whitelisted and judge the application not based on trust but based on what they allowed in their security controls (firejail, apparmor, seccomp, SElinux, ...) and so immediately see if they did something different (that breaks the promise/trust)? (even then browsers have million lines of code so even with best intentions ymmv) Reading/writing clipboards is a problem for sandboxing since they act as a bridge to another layer that otherwise has no contract or understanding of the application. So are many other features not just on browsers but on any application that for some reason needs to handle a gazillion tings (on Linux subscribing to system/user dbus messages is a big issue and out of the box totally unmitigated). [1] If a monolith like chrome/firefox needs to understand/parse hundreds of protocols, technology-standards, etc, is a challenge to sandbox, maybe it isn't the sandboxing but the application that is the wrong tool for the users threat-model? Note, there is also Tor/Tails/QubesOS if isolation between user-space applications is a serious concern.
mminer237 6y ago
Yes, boo features. How dare other people be allowed to do things I don't want to do.
Apofis 6y ago
Not without permission, for sure. I dislike how some websites will add extra text when you copy.

IvanK_net 6y ago

It can be done only after the user confirms, that they want to allow the website to do it (similar to a webcam access, etc).

account42 6y ago
Is there also an option to never show that popup for any website?
- IvanK_net 6y ago
  This is up to a browser. I believe a browser should give you an option to decline all such requests by default, without asking you each time. Just like you can browse the web with JS disabled, without images, etc.

DyslexicAtheist 6y ago

if this is important to some users (to me it is) why blindly trust an application's claim of what it does without verifying/restricting it[1]? The IMHO logical step for a user (again most don't care) would be to sandbox the application with a precise set of calls that are whitelisted and judge the application not based on trust but based on what they allowed in their security controls (firejail, apparmor, seccomp, SElinux, ...) and so immediately see if they did something different (that breaks the promise/trust)? (even then browsers have million lines of code so even with best intentions ymmv) Reading/writing clipboards is a problem for sandboxing since they act as a bridge to another layer that otherwise has no contract or understanding of the application. So are many other features not just on browsers but on any application that for some reason needs to handle a gazillion tings (on Linux subscribing to system/user dbus messages is a big issue and out of the box totally unmitigated). [1] If a monolith like chrome/firefox needs to understand/parse hundreds of protocols, technology-standards, etc, is a challenge to sandbox, maybe it isn't the sandboxing but the application that is the wrong tool for the users threat-model? Note, there is also Tor/Tails/QubesOS if isolation between user-space applications is a serious concern.

mminer237 6y ago

Yes, boo features. How dare other people be allowed to do things I don't want to do.

Apofis 6y ago

Not without permission, for sure. I dislike how some websites will add extra text when you copy.