5 ms·
Cool site. I'm a bit annoyed that sites can seemingly overwrite your clipboard without confirmation, on Android at least!
by axaxs 6y ago
Cool site. I'm a bit annoyed that sites can seemingly overwrite your clipboard without confirmation, on Android at least!
- skzv 6y agoNo, it makes sense. "Copy this" buttons are common on websites, but probably require a button click to initiate. Since you clicked on a button, you provided the input necessary to copy to the clipboard.
- judge2020 6y agoCopying to the clipboard is unrestricted even without a click, but reading clipboard text requires a permission popup. https://web.dev/async-clipboard/#security-and-permissions:~:text=Permissions%20for%20copy%20and%20paste%20have%20been%20added%20to%20the https://web.dev/async-clipboard/#security-and-permissions:~:...
- axaxs 6y agoThis is exactly what I was thinking. Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but upon copy injects say, rm -rf ~ \n
- judge2020 6y agoThis can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942 https://security.stackexchange.com/a/113630/96942
- axaxs 6y agoReally interesting(and terrifying) reads, thank you.
- kelnos 6y agoSeems like this requires you to select some text (which includes some text that's been hidden using CSS tricks) and copy it. So it's not like the website can just arbitrary write to your clipboard without your interaction? (Still, this is kinda scary and I didn't know about this.)
- input_sh 6y agoThey can append the message to whatever you'll actually want to copy, which is how websites used to do things like this. - Copied from https://news.ycombinator.com/item?id=26590437 https://news.ycombinator.com/item?id=26590437
- SilverRed 6y agoThe real bug is that \n pasted in to the terminal counts as hitting enter. iTerm has fixed this but every linux terminal I have used has this issue.
- vanviegen 6y agoIs it still possible to paste into vim, for example? If so, how does the terminal make the distinction?
- shakna 6y agoEvery Linux terminal I've used has a pop-up when there's a new newline. Like this, which in this case is xfce4-terminal. [0] [0] https://i.imgur.com/ubCXASQ.png https://i.imgur.com/ubCXASQ.png
- PowerBar 6y agoHuh, I've never gotten a prompt like that in Terminator.
- judge2020 6y agoSame for Windows Terminal: https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86wUU.png https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86...
- axaxs 6y agoGnome-terminal, probably the largest by user base, does not sadly.
- kelnos 6y agoIs it? When I click the "Write" button, it turns green, but when I click "Write (delayed)", after a while it turns red. So it seems (at least on Firefox 87) even the clipboard write API is restricted to user-action event handlers.
- mrtksn 6y agoIt’s also a privacy issue. Google’s Firebase Dynamic links is using it non-maliciously to survive app installs for deep linking(when the app is not installed it helps you redirect the user to the correct screen after the install), however any webpage can actually put something on your clipboard and match you on an app by reading your clipboard. With iOS14 at least we can tell when apps are reading the clipboard.
- walrus01 6y agoSeems like a great method to social engineer people into copying to clipboard something that will install a trojan, get them to open a command prompt and paste it, in the general concept of curl piped into a shell.