24 ms·

From the chrome bug[0] it seems like this was changed to work without a gesture because the new tab page needs to copy text for a Google Doodle... So instead o

From the chrome bug[0] it seems like this was changed to work without a gesture because the new tab page needs to copy text for a Google Doodle... So instead of changing their new tab page to require a gesture like all other sites... they decided to allow any website to copy text into the clipboard. Nice. I think copying into the clipboard needs an overhaul—even with a gesture. Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed. [0] crbug.com/1334203

zzo38computer 4y ago
One thing that should be done is a user setting to configure this capability. If it is disabled then their copying to clipboard does not have any effect (this is not detectable by the web page), except if you push the key combinations (or menu items) to normally do so while the text is selected in which case only that text is copied to the clipboard. This also would affect which text can be selected, too, not only the clipboard. Disabling fonts also can be possible, etc. (On my computer I usually disable the scripts so that it will not do such a things, but even if scripts are enabled, you might want to configure that feature too.)
- BeefWellington 4y ago
  Firefox does this via the setting: dom.event.clipboardevents.enabled
matheusmoreira 4y ago
> Don't you hate when news sites add a "- from XYZ" to your clipboard? And then there's the "clever" sites that replace the text I copied with a message like "haha you thought you could copy this? think again sucker".
- zebracanevra 4y ago
  I feel like if you've selected some text, then pressing copy should always copy that text and nothing else. But then: what's to stop websites from detecting you've selected text, unselecting it, and copying the bad text in, and then reselecting it... There are so many loopholes I can imagine to get around these restrictions :(
  - justahuman74 4y ago
    Why are websites allowed to know that you've selected plain text? (genuinely clueless on web stuff)
    - zebracanevra 4y ago
      I think there are a bunch of decent uses for that, like rich text editors (eg select text, hit ctrl-b, and the text is bolded). There are also some sites that popup a small box above your selection with a share box. Straight to hell with those. Compulsive selectors go mad on those sites. That's you, medium.com.
      - denton-scratch 4y ago
        But why does a rich text editor need to talk to a website?
        LocalH 4y ago
        What if the rich text editor and the website are the same thing? What if the rich text editor is part of a larger tool that is the website?
        denton-scratch 4y ago
        Well, I'm not sure what you're waving at. If the website is nothing more than a RTE, then it's better (and safer) to do it in the browser. If the RTE is just part of the website, then that's a part that's better done in the browser. Perhaps you want a RTE that doesn't depend on JS. I think that's a reasonable thing to want; but if you normally browse with JS switched off, then running into a working RTE is at least going to violate the Principle of Least Surprise.
    - entropie 4y ago
      Why are websites allowed to know that I hover an element? Javascript knows about clicks, doubleclicks, hovers... like almost every interaction the user does. There are use cases but also potential to be exploited somehow.
- jacquesm 4y ago
  That's pretty benign. Replacing it with "rm -rf /" would be a lot nastier. (And will teach people not to browse with root windows open ;) ).
- blep-arsh 4y ago
  Firefox has (had?) a flag to disable clipboard-related JS events but this flag is global and toggling it breaks copying from various rich text editors.
kitsunesoba 4y ago
This is why a web and ad giant shouldn’t be in charge of the world’s most popular browser as well as the world’s most popular web engine. Huge conflict of interest. Chrome should be spun off into a non-profit that is barred from Google/Alphabet influence.
- stingraycharles 4y ago
  Mozilla did some pretty nefarious things with Firefox as well though, for some marketing campaigns. Not saying it’s worse, but it may not necessarily be due to Google also being an ad giant, but just corporations being corporations and having the wrong priorities.
  - dcdc123 4y ago
    I’ve been thinking about switching back to Firefox. Care to share an example?
    - christophilus 4y ago
      Probably the Mr Robot thing. I mostly use Firefox (and recommend it), but they do appear to be run by MBAs or marketers— not sure which.
      - ipaddr 4y ago
        Love the Mr Robot addon.
      - greenhatman 4y ago
        It wasn't always like that. I think it changed 2 or 3 years ago.
      - xref 4y ago
        That was such a strange choice by Mozilla, I mean the plug-in was specifically for people who play the Mr Robot game. Even after Mozilla force-pushed it to their entire user base players still had to manually enable it to play. If the whole damn thing required manual intervention anyway why didn’t they just put it in the addon store to start with?!
ndriscoll 4y ago
> Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I opened a bug with chromium when I first encountered that behavior ~10 years ago since it was an obvious security and privacy concern to me. Needless to say, the chromium devs didn't think it's an issue. You would think browsers would ask permission for sites to do things like modify your clipboard, see when you copy/paste, track your mouse movements and text selections, etc. but google obviously isn't going to care about protecting the user from such things.
- chalupa-man 4y ago
  You don't need to modify the clipboard to do that, news sites were doing it long before the clipboard API existed. It's usually done with CSS, abusing display properties, positioning, font size, etc to make attributions a non-visible but still copied part of the text.
lapcat 4y ago
> Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed. There are browser extensions. For example, my own StopTheMadness on macOS and iOS: https://underpassapp.com/StopTheMadness/ https://underpassapp.com/StopTheMadness/ I'm going to work on this navigator.clipboard issue, because I find it unsettling, and I use Chrome quite a bit.
zetafunction 4y ago
Disclaimer: I am a Chrome developer, who formerly worked on the clipboard. For a long time, Chrome did not allow pages on the open web to use document.execCommand('copy') or document.execCommand('cut'), and there was a fairly steady stream of requests from web developers to enable this. Eventually, Chrome did expose this gated behind a user gesture: https://chromestatus.com/feature/5223997243392000 https://chromestatus.com/feature/5223997243392000 > So instead of changing their new tab page to require a gesture like all other sites... they decided to allow any website to copy text into the clipboard. Nice. Ownership of the clipboard features has moved around a bit, and sometimes historical context around things like the user gesture requirement are lost. Here, the NTP doesn't actually need this to work without a user gesture. The correct fix here is to fix the NTP tests to correctly simulate a user gesture, not to allow writing to the clipboard without a user gesture. > I think copying into the clipboard needs an overhaul—even with a gesture. Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed. This is a difficult problem to fix. There are absolutely websites that abuse this. But there are also pages that do use the legacy clipboard API events in non-abusive ways (e.g. rich text editors), and blocking this outright would break legitimate uses as well. Maybe something like a "copy as plain text" option would make sense...
- userbinator 4y ago
  Why do you call it a "user gesture" and not "consent" as it should absolutely be? Is it to reinforce the notion that users' actions are only to be taken as mere suggestions and ignored if they are contrary to your goals?
  - PoignardAzur 4y ago
    > Is it to reinforce the notion that users' actions are only to be taken as mere suggestions and ignored if they are contrary to your goals? Wow, rude. One possible answer to your question: there is no way for a browser to detect "consent", which is a subtle and nuanced concept, but user gestures have a hard and fast definition, so that's the proxy they use.
dawnerd 4y ago
A long time ago I developed a way to append that text you’re talking about as an in house feature so we didn’t have to use that service whose name is escaping me right now. Probably spent two weeks making it cross browser. It was fairly simple at the end of the day and didn’t require any exploits to the clipboard api, just some really good assumptions to and timing it just right to flip some selection. The hard part was restoring the users original selection without making it obvious. I still hate that I did this.
samatman 4y ago
Google search could put an end to that practice by having crawlers select and copy some text, and penalizing sites which gunk up the results. Will they? Hah.

zzo38computer 4y ago

One thing that should be done is a user setting to configure this capability. If it is disabled then their copying to clipboard does not have any effect (this is not detectable by the web page), except if you push the key combinations (or menu items) to normally do so while the text is selected in which case only that text is copied to the clipboard. This also would affect which text can be selected, too, not only the clipboard. Disabling fonts also can be possible, etc. (On my computer I usually disable the scripts so that it will not do such a things, but even if scripts are enabled, you might want to configure that feature too.)

BeefWellington 4y ago
Firefox does this via the setting: dom.event.clipboardevents.enabled

matheusmoreira 4y ago

> Don't you hate when news sites add a "- from XYZ" to your clipboard? And then there's the "clever" sites that replace the text I copied with a message like "haha you thought you could copy this? think again sucker".

zebracanevra 4y ago
I feel like if you've selected some text, then pressing copy should always copy that text and nothing else. But then: what's to stop websites from detecting you've selected text, unselecting it, and copying the bad text in, and then reselecting it... There are so many loopholes I can imagine to get around these restrictions :(
- justahuman74 4y ago
  Why are websites allowed to know that you've selected plain text? (genuinely clueless on web stuff)
  - zebracanevra 4y ago
    I think there are a bunch of decent uses for that, like rich text editors (eg select text, hit ctrl-b, and the text is bolded). There are also some sites that popup a small box above your selection with a share box. Straight to hell with those. Compulsive selectors go mad on those sites. That's you, medium.com.
    - denton-scratch 4y ago
      But why does a rich text editor need to talk to a website?
      - LocalH 4y ago
        What if the rich text editor and the website are the same thing? What if the rich text editor is part of a larger tool that is the website?
        denton-scratch 4y ago
        Well, I'm not sure what you're waving at. If the website is nothing more than a RTE, then it's better (and safer) to do it in the browser. If the RTE is just part of the website, then that's a part that's better done in the browser. Perhaps you want a RTE that doesn't depend on JS. I think that's a reasonable thing to want; but if you normally browse with JS switched off, then running into a working RTE is at least going to violate the Principle of Least Surprise.
  - entropie 4y ago
    Why are websites allowed to know that I hover an element? Javascript knows about clicks, doubleclicks, hovers... like almost every interaction the user does. There are use cases but also potential to be exploited somehow.
jacquesm 4y ago
That's pretty benign. Replacing it with "rm -rf /" would be a lot nastier. (And will teach people not to browse with root windows open ;) ).
blep-arsh 4y ago
Firefox has (had?) a flag to disable clipboard-related JS events but this flag is global and toggling it breaks copying from various rich text editors.

kitsunesoba 4y ago

This is why a web and ad giant shouldn’t be in charge of the world’s most popular browser as well as the world’s most popular web engine. Huge conflict of interest. Chrome should be spun off into a non-profit that is barred from Google/Alphabet influence.

stingraycharles 4y ago
Mozilla did some pretty nefarious things with Firefox as well though, for some marketing campaigns. Not saying it’s worse, but it may not necessarily be due to Google also being an ad giant, but just corporations being corporations and having the wrong priorities.
- dcdc123 4y ago
  I’ve been thinking about switching back to Firefox. Care to share an example?
  - christophilus 4y ago
    Probably the Mr Robot thing. I mostly use Firefox (and recommend it), but they do appear to be run by MBAs or marketers— not sure which.
    - ipaddr 4y ago
      Love the Mr Robot addon.
    - greenhatman 4y ago
      It wasn't always like that. I think it changed 2 or 3 years ago.
    - xref 4y ago
      That was such a strange choice by Mozilla, I mean the plug-in was specifically for people who play the Mr Robot game. Even after Mozilla force-pushed it to their entire user base players still had to manually enable it to play. If the whole damn thing required manual intervention anyway why didn’t they just put it in the addon store to start with?!

ndriscoll 4y ago

> Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I opened a bug with chromium when I first encountered that behavior ~10 years ago since it was an obvious security and privacy concern to me. Needless to say, the chromium devs didn't think it's an issue. You would think browsers would ask permission for sites to do things like modify your clipboard, see when you copy/paste, track your mouse movements and text selections, etc. but google obviously isn't going to care about protecting the user from such things.

chalupa-man 4y ago
You don't need to modify the clipboard to do that, news sites were doing it long before the clipboard API existed. It's usually done with CSS, abusing display properties, positioning, font size, etc to make attributions a non-visible but still copied part of the text.

lapcat 4y ago

> Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed. There are browser extensions. For example, my own StopTheMadness on macOS and iOS: https://underpassapp.com/StopTheMadness/ https://underpassapp.com/StopTheMadness/ I'm going to work on this navigator.clipboard issue, because I find it unsettling, and I use Chrome quite a bit.

zetafunction 4y ago

Disclaimer: I am a Chrome developer, who formerly worked on the clipboard. For a long time, Chrome did not allow pages on the open web to use document.execCommand('copy') or document.execCommand('cut'), and there was a fairly steady stream of requests from web developers to enable this. Eventually, Chrome did expose this gated behind a user gesture: https://chromestatus.com/feature/5223997243392000 https://chromestatus.com/feature/5223997243392000 > So instead of changing their new tab page to require a gesture like all other sites... they decided to allow any website to copy text into the clipboard. Nice. Ownership of the clipboard features has moved around a bit, and sometimes historical context around things like the user gesture requirement are lost. Here, the NTP doesn't actually need this to work without a user gesture. The correct fix here is to fix the NTP tests to correctly simulate a user gesture, not to allow writing to the clipboard without a user gesture. > I think copying into the clipboard needs an overhaul—even with a gesture. Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed. This is a difficult problem to fix. There are absolutely websites that abuse this. But there are also pages that do use the legacy clipboard API events in non-abusive ways (e.g. rich text editors), and blocking this outright would break legitimate uses as well. Maybe something like a "copy as plain text" option would make sense...

userbinator 4y ago
Why do you call it a "user gesture" and not "consent" as it should absolutely be? Is it to reinforce the notion that users' actions are only to be taken as mere suggestions and ignored if they are contrary to your goals?
- PoignardAzur 4y ago
  > Is it to reinforce the notion that users' actions are only to be taken as mere suggestions and ignored if they are contrary to your goals? Wow, rude. One possible answer to your question: there is no way for a browser to detect "consent", which is a subtle and nuanced concept, but user gestures have a hard and fast definition, so that's the proxy they use.

dawnerd 4y ago

A long time ago I developed a way to append that text you’re talking about as an in house feature so we didn’t have to use that service whose name is escaping me right now. Probably spent two weeks making it cross browser. It was fairly simple at the end of the day and didn’t require any exploits to the clipboard api, just some really good assumptions to and timing it just right to flip some selection. The hard part was restoring the users original selection without making it obvious. I still hate that I did this.

samatman 4y ago

Google search could put an end to that practice by having crawlers select and copy some text, and penalizing sites which gunk up the results. Will they? Hah.