17 ms·

Don't fuck with paste

• pupppet 3y ago
  Right up there with hijacking Ctrl-F.
  • grishka 3y ago
    I just don't get it why browsers allow websites to override their own hotkeys. I'm sure it even required extra code to be written to work correctly. Linear hijacks Cmd+F for example, very helpfully providing some terrible thing instead of my browser's built-in search that works the same everywhere. (it's the same Linear that thinks you can't not want wysiwyg markdown editing)
    • nsinreal 3y ago
      Well, for Ctrl+F there is sometimes a reason. Many websites uses technique called virtualization of lists. That boosts performance, but standard Ctrl+F doesn't works anymore properly
      • BasieP2 3y ago
        I know of 2 websites that do this. 1. Confluence It's super annoying and takes up a lot of screen space 2. Nexus It simply kills it. You can use ctrl-f but it simply will not find text right in front of you.. Really i see no valid case
        • rasz 3y ago
          github code editor is a big one
        • PennRobotics 3y ago
          DOS emulator and Vim emulator, and that's almost all I can imagine. Maybe games that would use the control key as an additional input---but in the browser???
      • aitchnyu 3y ago
        The good sites allow you to hit ctrl f twice to get browser's find feature.
  • oneeyedpigeon 3y ago
    'Find in page' is now so broken on modern websites that the keyboard shortcut is the last of our problems.
    • PennRobotics 3y ago
      Bitwarden. "Find in page" will only show a result if it is visible on the page (even though the scrollbar indicates the full vault has loaded, and even after scrolling down to the desired result and then back up). They have a "Search vault" field that works fine, so it's not a major inconvenience, but the first few times I've Ctrl+F'd a newly added site and gotten "Phrase not found" when I know I added credentials? That's a mild anxiety I'd rather not have. I could be convinced there's a security-related reason for this---in fact, I never really thought about it until now---but then I'd assume anyone able to get access to your vault can use Selenium and fill in the "Search vault" input field.
  • LM358 3y ago
    I don't think anyone here can imagine my bewilderment, confusion, and ultimately anger, the day I discovered that in the web interface for Outlook, Ctrl+V is the default shortcut for... send email. I would very much like to know what went through their heads when they decided on that. On further thought, maybe I don't.
  • Lio 3y ago
    My personal hate is when webpages rebind scrolling to zoom. I haven't used a mouse in almost 15 years. It's a constant source of annoyance when I try to scroll something with a map with my trackpad and it goes crazy zooming in and out.
  • stn_za 3y ago
    So much this.
  • tom_ 3y ago
    And overriding Ctrl+K without even being so good as to give way when you type it a second time. Assholes.
    • oneeyedpigeon 3y ago
      We're talking about you, Slack. (At least I can now remember which app is the one that breaks Cmd-K, but it's still annoying that I have to think that little bit longer to recall that info. every single time I press Cmd-K anywhere)
  • lukeholder 3y ago
    Stripe docs do that and it annoys me to no end. They let you use the native search if you press ctrl+f a second time but since there is a delay it causes chaos.
  • dugite-code 3y ago
    Hell just hijacking any standard browser controls is infuriating when it catches you out when you're just not paying complete attention. Edit: Apparently Firefox has the `permissions.default.shortcuts` config option UNKNOWN: Services.perms.UNKNOWN_ACTION [0] ALLOW: Services.perms.ALLOW_ACTION [1] BLOCK: Services.perms.DENY_ACTION [2] PROMPT: Services.perms.PROMPT_ACTION [3] And in the site information panel you can disable the Override keyboard shortcuts permission on a per-site basis. Neat, doesn't solve the paste override issue though. Source: https://support.mozilla.org/en-US/questions/1241294#answer-1175070 https://support.mozilla.org/en-US/questions/1241294#answer-1...
    • crtasm 3y ago
      A huge thanks for making me aware of this. permissions.default.shortcuts firmly set to 2.
  • strbean 3y ago
    Recently learned that if you Ctrl-F again after the highjacking, it brings up the browser search box. Discovered this thanks to a site (don't remember which) that included a tooltip about this fact in their hijacked search box. I was curious if it would work on Redocly search, which has no such tooltip, and it did. I'm not positive if this works universally, or is just an undocumented feature of Redocly's interface and won't work in places the developers didn't make specific accommodations for it. Env: Chrome + OSX or Windows.
    • pzmarzly 3y ago
      It's a feature built-in to most browsers, same with right-click (if page hijacks right click, right-click twice in rapid succession).
      • strbean 3y ago
        Thanks for the info!
  • notamy 3y ago
    Ctrl-G and F3 often work to bypass that ime
    • dugite-code 3y ago
      I honestly didn't know about Ctrl-G. You my have significantly changed my life!
      • dylan604 3y ago
        isn't ctrl-g common for "find next" with shift-ctrl-g "find previous"? maybe i live too much in my IDE/text editors?
        • kayodelycaon 3y ago
          On macOS cmd+g is a standard shortcut most apps implement.
          • dylan604 3y ago
            yeah, i substituted to ctrl from my normal cmd to not confuse people
        • dugite-code 3y ago
          Almost certainly, but It's one of of these "I can't believe I never knew this, it's so obvious!" things.
          • dylan604 3y ago
            In that case, I'd highly recommend browsing through the drop down menus for any of your apps. It is very common* for the keyboard shortcut to be listed, and very frustrating when it is not. This is my primary source for finding these shortcuts for a new app. * maybe it's a Mac thing???
        • Andrex 3y ago
          In my head Ctrl+G is a shortcut for "Ctrl+F with the last result I searched for."
  • dylan604 3y ago
    There's a lot of keyboard shortcuts that mean one thing in the browser but something totally different in another application. Now that it is common for many of these other applications to now be a web app, these keyboard short cuts are possible to start colliding. Take GoogDocs as an example. Do you want the browser's find or the app's find if you hit ctrl-f in a Doc/Sheet/etc? The vast majority of the users want the app's. Reading a news site, most people would probably expect ctrl-f for the browser's search. Just pointing out that hard rules will always have exceptions. Except for the TFA's point of copy/paste. Stop manipulating my clipboard with bullshit marketing/tracking bullshit!!!!!!!
    • 8338550bff96 3y ago
      Then the vast majority of users are wrong. The correct answer is for it be the browser's find. Maybe apps could bind their find/search to ctrl-s since it is incorrect for browsers to bind this to save-page anyway.
      • dylan604 3y ago
        why is all of the sudden ctrl-s wrong by the browser?? you make no sense here. you've never needed to save a web page? i guess i'm showing my age, while i don't use it daily, it has been a valuable feature for many reasons before. Edit: >Then the vast majority of users are wrong. I strongly disagree, and people unwilling to be flexible ruins the experience as those people tend to be the minority
        • pinkmuffinere 3y ago
          You’re absolutely correct though, the parent comment seems to think there are absolute right and wrong answers for UI. I think that’s just not true, a good UI is one that works for your customers.
          • 8338550bff96 3y ago
            Hey, man. I'm just dispensing justice. I don't make the rules
  • makeitdouble 3y ago
    There are semi-legitimate cases where this is warranted. For instance when looking at a Notion database, standard Ctrl-F is almost useless, and document search needs to go through the notion API to return results, sometimes even related to the entries that are displayed on screen. I say "semi-legitimate" because I actually wish they'd map to a different shortcut, but can see the case for user wanted the remapping. This of course stems from earlier decisions to have that document handling style in the first place. IMHO it becomes a complex debate when on line between an online application and a webpage.
    • AA-BA-94-2A-56 3y ago
      Shouldn’t CMD+F be reserved to searching the current document/context? Something like CMD+K should be used for a more global search.
      • easton 3y ago
        You cant use those keys (Super+) in the browser AFAIK. The operating system expects to use them for keyboard shortcuts. (Guessing on macOS Cmd+V is actually triggering a clipboard event in JS, the site can’t actually see that you pressed Cmd+V)
      • deleted 3y ago
        [deleted]
  • AA-BA-94-2A-56 3y ago
    Stripe’s API documentation does this and it gives me the shits, because it seizes up my M2 MacBook Pro for several seconds. I can’t believe that it’s 2024, and I can’t simply grep some documentation.
    • deleted 3y ago
      [deleted]
    • ytpete 3y ago
      Cmd-L followed by Cmd-F will always get you the real browser search, at least.
    • deleted 3y ago
      [deleted]
    • dotancohen 3y ago
      The Vimperator/Tridactyl (Firefox VI shortcuts extension) search / is not hijacked on the Stripe API documention.
      • bovine3dom 3y ago
        FWIW, the / search isn't part of Tridactyl but we do inject some code that frees up / from most websites so Firefox can use it. It's possible to write your own user script to do it (you just need to add a keypress event handler that does preventDefault() and maybe stopPropagation()) with no need for Tridactyl :)
        • SushiHippie 3y ago
          But it still doesn't seem to work on GitHub, did you whitelist GitHub for the preventDefault or is GitHub just a bit extra when it comes to hijacking keybinds?
          • bovine3dom 3y ago
            It works sometimes on GitHub, it's just a bit extra as you said. GitHub is what annoyed me enough to make the feature in the first place. It used to work reliably but they made it worse :(
  • gardnr 3y ago
    Jeff Atwood has an opinion: https://meta.discourse.org/t/options-to-disable-hijack-of-cmd-f-ctrl-f-and-keys-for-search/16875/17 https://meta.discourse.org/t/options-to-disable-hijack-of-cm...
  • int_19h 3y ago
    This is the biggest reason why I hate Discourse.
• est 3y ago
  I think browsers need to implement an optional <body onload="disable_javascript()"> feature. Stop js shit after the page loads complete. Only enable js when user interacts with a button or something.
• assimpleaspossi 3y ago
  Do we really have to put up with vulgarity even on HN? It's bad enough to see it in the title--cause someone will say that's what the title is--but, as can be seen, it breeds unnecessary vulgarity throughout this thread. To see the irony of it all, I'll get fucking downvoted for fucking complaining about this fucking shit and maybe get really fucked up by getting fucking banned. Do you get my fucking point?
  • geraldhh 3y ago
    vulgarity in the tile makes sense, in your comment not so much. if you don't get the point you may gtfo or make new account
  • mtlmtlmtlmtl 3y ago
    I don't understand people who give a shit about vulgarity. And more importantly, people that expect other people to adjust to them. They're just fucking words. Lots of little things about the way some people write or speak may annoy me, like their dialect or some word/phrase they use too much, but the adult thing to do is to fucking deal with it and keep it to yourself. It's your problem, not everyone else's.
  • jjgreen 3y ago
    You kiss your mother with that mouth?
• koenraad 3y ago
  By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…
  • globular-toast 3y ago
    I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove one particular character. Would it really be that difficult to display password strength and say things like "use more characters, e.g. you could use four words".
    • _0ffh 3y ago
      > Even worse, there are some that restrict what kind of special character you can use Even worse, there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!
      • piyush_soni 3y ago
        Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|
        • oneeyedpigeon 3y ago
          "look, just tell me what you want my password to goddam be, and I'll go with that!"
• bluish29 3y ago
  For me this is annoying and I really hate websites hijacking paste. But it is more annoying on the phone specially when creating passwords with password manager. Does anyone know something that will work for safari?
• Fnoord 3y ago
  Hmm, if it JS, don't allow JS by default? uMatrix for example works in that regard.
• MaxikCZ 3y ago
  Is there a way I can tell my browser to always force draging over text to secelt that text, regardless if its a hyperlink?
  • flyflyFenix 3y ago
    Hold alt and then select text with left-click drag. It works most of the time. Enjoy :)
    • out-of-ideas 3y ago
      key words: most of the time like when you get trolled by Atlassian's crap tier website where the wiki/jira-pages do not allow selecting some text blocks (and makes it even harder to tell somebody to browser-page-search for a particular string)
  • deleted 3y ago
    [deleted]
• vault 3y ago
  Anyone one else noticed OP got 399 upvotes for sharing a fork with no significant upgrades compared to the original repo?
  • delegate 3y ago
    Oh yes, 3 files changed compared to parent and the changes are gitignore and updated URLs to the forked repo.
  • MezzoDelCammin 3y ago
    yep. Quite the WTF
  • mrunkel 3y ago
    Well, this is for firefox, and the other is for Chrome, so maybe that's a significant upgrade?
  • Aissen 3y ago
    Original repo author rejected the PR for Firefox support, so the owner of the fork did just that - fork to add 6 lines of manifest: https://github.com/jswanner/DontF-WithPaste/pull/29 https://github.com/jswanner/DontF-WithPaste/pull/29 (I admit though that the unrelated .gitignore change had nothing to do in the original PR)
  • luzojeda 3y ago
    IMO upvotes are due more to a "Yes, I agree, hate when that happens" than a "Thank you for this useful tool OP"
  • zettabomb 3y ago
    The fork is for supporting Firefox, which I consider to be a significant upgrade as I don't use Chrome in the first place. You can see the original repo easily, but it's far more annoying with GitHub to find a particular fork. I can keep it to myself next time if it offends you that much though, no reason to tell other people on HN about something I found interesting.
• deleted 3y ago
  [deleted]
• quitit 3y ago
  For mac/iOS users on Safari, Firefox or Chrome: StopTheMadness is also a handy utility that tames these and other website bad behaviours. https://underpassapp.com/StopTheMadness/ https://underpassapp.com/StopTheMadness/
• blkhawk 3y ago
  This is why I build an external password thing that emulates a keyboard. Nothing some stupid braindead "security" implementation can do to prevent that from working. It does TOTP too. I had fun with hooking it up to my phone via BT for proximity unlocking. Part of its secret lives on the phone. I wouldn't say it very secure since i didn't bother with implement a proper asnc encryption for the bt part. And its still vulnerable to a variety of evil maid attacks. My threat model doesn't involve that to ever matter. It should be practically fully resistant to remote full-take attacks.
• tracker1 3y ago
  This really irks me to no end with password managers in particular. I like to generate 30 character random passwords and sites that limit input or block paste in the verify field are particularly annoying. Similar for login and 2FA entry fields. There's no good reason for it. I've often gone an extra bit to ensure password managers work well. I wish more sites would do the same.
  • ggrelet 3y ago
    I find passphrases to be better at tackling this exact scenario (and others). The password is long and secure but easy to type because it’s composed with actual English words.
• visarga 3y ago
  My peeve with copy&paste is that it often fails to copy, not to paste. I sometimes need to copy three times until I succeed a paste. Does anyone see this problem?
• seqizz 3y ago
  Alternative for linux users, which "types" the thing on clipboard to the window you select: alias pasteplease='xclip -selection clipboard -out | tr \\n \\r | xdotool selectwindow windowfocus type --clearmodifiers --delay 25 --window %@ --file -'
• whywhywhywhy 3y ago
  Find it utterly infuriating when devs feel the need to disable me autocomplete settings, spellchecking or paste. Like I have a setting to auto insert my email if I type @@ and so many input fields have text complete disabled somehow despite me using it as a sure fire way my email is correct. Disabling spellchecking or rolling your own spellchecking is the most egregious of all
  • lapcat 3y ago
    In Safari, disabling spellcheck also disables text replacement: https://bugs.webkit.org/show_bug.cgi?id=214493 https://bugs.webkit.org/show_bug.cgi?id=214493
• nedt 3y ago
  In case of not being able to past I normally right click -> inspect element and in the console write $0.value="value from clipboard". Works almost everywhere. Tampering with paste is kinda is like turning of autofill and the HTML5 standard is pretty clear when it should only be turned of: ".. particularly sensitive (for example the activation code for a nuclear weapon); or that it is a value that will never be reused (for example a one-time-key for a bank login) ..."
  • causal 3y ago
    That plainly seems like a mistake in the standard that harms security. What's the reasoning there? That somehow human fingers are less prone to error than password managers? The only thing I can think of is malware changing the value of the clipboard to fool someone into pasting the wrong thing - but if you open that scenario then you've got all kinds of ways malware could mess with a manually typed field too.
    • nedt 3y ago
      I see I was missing an f in off. The standard says unless it's an interface on a WMD or similar let the browser autofill. The part of one time passwords that might have been indeed obsoleted by 2FA. On the other hand we might still want a single user interaction there even if it's just confirming the full value instead of typing in the 6 digits - much like passkey is doing it.
      • deleted 3y ago
        [deleted]
• pluc 3y ago
  Just turn off Javascript with No-Script and selectively turn it on. It makes the web such a better place.
• amarant 3y ago
  Tangential at best, but this project made me think of evilpass, which is the funniest password validation scheme ever! It probably does increase security, but it also gives the impression of actively hacking you. https://github.com/kitzin/evilpass https://github.com/kitzin/evilpass
• graynk 3y ago
  I normally just inspect the element in dev tools and disable the attached paste event handler. Not the most convenient way, but also I don’t need to do it all that often
• 2024throwaway 3y ago
  I use Hammerspoon for Mac, have a shortcut set up for Cmd+Shift+V to actually type the letters rather than use the paste function. Works every time someone pulls this stunt. > hs.hotkey.bind({"cmd", "shift"}, "V", function() hs.eventtap.keyStrokes(hs.pasteboard.getContents()) end)
  • brushfoot 3y ago
    I do the same with AutoHotkey for Windows. It's also come in handy in remote connection GUIs that default to the remote clipboard and legacy desktop applications with controls that don't support pasting.
  • reaperman 3y ago
    I also do this with AHK on Windows, even using the same keystroke. Though I add a small 10-50ms delay between each keystroke, otherwise the input can get mangled sometimes.
  • naltroc 3y ago
    Yessss this also solves for Google Sheet's overkill hijack
  • danlugo92 3y ago
    > have a shortcut set up for Cmd+Shift+V to actually type the letters Seems like this would be hard to "google"... can you provide a guide or a link to a guide on how to accomplish this?
    • ihumanable 3y ago
      Maybe try googling the very easy to google for "Hammerspoon" and the guide would literally just be the comment you are replying to.
  • rattray 3y ago
    Thank you. I added this myself, but with option instead of shift (because cmd+shift+v already does "paste without formatting" iirc) like so: -- https://news.ycombinator.com/item?id=39640745 hs.hotkey.bind({"cmd", "alt"}, "V", function() hs.eventtap.keyStrokes(hs.pasteboard.getContents()) end)
• fortran77 3y ago
  My HMO does this, and I've complained year after year. They also specify a limit of 15 characters in the text above the "change your password" field, but it actually is limited to 14 characters. Imagine the frustration when you type in a 15-character randomly generated (from a password generator) password twice, and then have the system reject it because it is too long! If I ever have any extra time, I'll see if I can sue Sutter Health for an "ADA" or similar violation over this.
• oldandboring 3y ago
  I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the requirements and I implemented them. I asked my client why we had to do this, when "everyone" knows that this stuff is terrible user-experience and can backfire spectacularly for security (the same people who would memorize a shitty password and use it everywhere, will now write their expiring, "strong", impossible-to-remember password on a sticky note or save it to a text file or spreadsheet called 'passwords.txt' on their Desktop). The answer is: we have to, for compliance. To pass a security audit. To prove to some major client or insurance company that we have a number of industry-standard measures in place to improve security. Unfortunately, your bank does not care about the 2% of us using password managers. Everyone else is still memorizing passwords, forgetting them, and making jokes about it like it's 2003.
  • hartator 3y ago
    > The answer is: we have to, for compliance. Do they? I don’t remember seeing any compliance requirements you can’t reasonably push back. This is just overzealous compliance consultants meeting a team that doesn’t really care about their users. People never really question anything.
    • alex3305 3y ago
      > Do they? Probably not. In my experience most standards are pretty broadly defined with hardly any technical requirements. For instance in ISO 27001 it states that you should create awareness in your organisation about information security. A very minimal way is to send a mass email to everyone in the organisation or hang up posters in the office. But I also spoke to someone that was determined that a half day security awareness training was minimally required.
      • PH95VuimJjqBqy 3y ago
• alwayslikethis 3y ago
  This should really be a browser config option or context menu item, among other things. Browsers today take far too much control out of the user to allow web developers to create hostile websites. - Force select - Force copy - Force paste - Spoof tab visibility ("Don't make me watch" extension) - Force right click (Firefox has this)
• BiteCode_dev 3y ago
  What's the difference with "absolute enable right click and copy"? (https://chromewebstore.google.com/detail/absolute-enable-right-cli/jdocbkpgdakpekjlhemmfcncgdjeiika https://chromewebstore.google.com/detail/absolute-enable-rig...)
• jordanpg 3y ago
  Somewhere on this site is a developer who thinks this is a good idea. Or whose boss thinks this is a good idea. I'd love to hear a defense of this practice.
• j1elo 3y ago
  Merging the bookmarklet version of the upstream addon this one is forked from [1] and another bookmarklet that has been posted in comments here [2], I got to this: javascript:['copy','cut','paste','contextmenu','selectstart'].forEach(e=>document.addEventListener(e,e=>e.stopImmediatePropagation(),true)); Right now I cannot think of any page that inhibits pasting, what is a good candidate to test this out? [1]: https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-file#bookmarklet https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-fi... [2]: https://bookmarkl.ink/ashtonmeuser/6e3869d8e468e016f22a4b4de79509bd//no-paste.js https://bookmarkl.ink/ashtonmeuser/6e3869d8e468e016f22a4b4de...
• novoreorx 3y ago
  I find it more annoying when a site prevents me from copying content from it, is there a sibling project called “Don’t fuck with copy”?
• shufflerofrocks 3y ago
  Lol it is for this exact problem that I added one more shortcut to my script Ctrl+8 will paste in the latest item on my clipboard, and honestly it has been so helpful that I'm quite elated. I recommend others running a userscript for themselves, this extension is awesome, but it's something that can be broken again and again. not really a permanent solution
• BrandoElFollito 3y ago
  A bank had once the fucked up idea to require some characters of the password. It was a Polish bank and I know that another one there has the same idiotic idea. So you had to write down your passwords, map an index (1, 2, 3, ...) to each character and check the ones that match. But it was not all! You had a time limit! These idiots disabled it for some time and then apparently reenabled it again. I wonder, seriously, which education the inventor had and to which point his team was saying yes to everything.
• a1o 3y ago
  Last commit is 4yr ago but I remember using this in the past
• swayvil 3y ago
  Ya, fucking with paste is a pet peeve of mine. What's a good argument for fucking with paste?
  • freedomben 3y ago
    The only one I've ever heard is "security." Sometimes people try to "yeah it's because for security we don't want some tool to paste credentials or clickjacking mumble something malware hacking clipboard spyware javascript browser" but most of the time the truth is "our sec people need to show controls for hardening the authentication process so they came up with that and we just did it because it wasn't worth the fight" I've also heard "being able to copy/paste defeats the purpose of having a 'confirm email' field." I reject that but it's at least somewhat logical.
    • ryandrake 3y ago
      Too much gets justified with vague, handwavey "because security" excuses. We can't do this because... uh... because security, yea, that's it! It should be "Specific vulnerability or GTFO."
      • styxfrix 3y ago
        Yeah. NordVPN is an example of this handwaviness. They refuse to delete my account to which I can successfully log into and which I've never used because they claim that as "a security-oriented company we do not take account change or deletion requests lightly, hence we request payment information to confirm ownership of the account, as we would not want anyone but the rightful owner making such changes." Problem being, I've never paid NordVPN, and when I told them as much and asked what security problem could result from them deleting an unused account, they didn't respond.
        • techvada 3y ago
          [dead]
    • bogota 3y ago
• theflyingelvis 3y ago
  Seems like a cool idea but perhaps a slightly less offensive name would be good.
  • jfoutz 3y ago
    seems like an unmaintained fork of the less provocative, https://github.com/jswanner/DontF-WithPaste https://github.com/jswanner/DontF-WithPaste
    • theflyingelvis 3y ago
      I mean it doesn’t really offend me but it would be difficult to say recommend it to my mom. I guess it’s just me.
      • freedomben 3y ago
        Agreed. It doesn't offend me personally, but it's considered NSFW language in most workplaces. I would never name a project like that
        • arp242 3y ago
          > NSFW language in most workplaces It would have been fine literally everywhere I've worked. I'm not saying there aren't places where this can be an issue. Partly this seems to depend on the region – in the US, in particular, it seems to be a big no-no, which I find odd considering how fucking often fuck is in fucking American media – the fuck is up with that? But outside of that? It seems to be mostly a non-issue.
          • freedomben 3y ago
            Probably because the US does have a pretty wide diversity, particularly when it comes to religion. In some areas you'll find a lot of Mormons (who are greatly offended by "fuck"), and in some Christians (where some denonimations don't even like the word "crap" let alone "fuck"), in some Catholics who generally don't seem to care (I've heard some Catholic priests let loose some pretty blue streaks lol), and all kinds of others. Then there are people who aren't offended, but don't want to talk that way in front of their kids and don't allow their kids to talk that way. In a workplace in the US (where you can't discriminate based on religion as it's a protected class), it's a very bad idea to use that kind of language unless you know everyone around and you know that they don't mind. Even then, be aware of who might be nearby enough to hear. Getting an HR complaint against you for dropping an f-bomb is embarrasing and not very fun.
• megous 3y ago
  Used to be simple to workaround this with basic web APIs (el.value = 'whateverIwant'), until this newfangled web framework from Facebook broke the web.
  • alisonatwork 3y ago
    This. One especially infuriating trend appears to be not even using the HTML input box at all, the JavaScript just intercepts the keydown event which then (deliberately?) triggers a slow calculation before eventually rendering a star in the text-field-that-actually-isn't, breaking even "auto type" solutions. So you sit there like an idiot every time you log in, with your password manager open and password unmasked, copying each character, laboriously, one-by-one. I can't fathom how this sort of thing gets by management, who are presumably told it increases security, but then apparently never actually try to use the end product. Even worse is when the suggestion comes to use an app instead of the website, and then the app comes with its own dedicated keyboard that isn't your own phone's keyboard, because "security" and then they scramble the position of all the letters and numbers, making it even slower.
    • benmanns 3y ago
      Ahh 00s/10s era ING Direct and TreasuryDirect. I think TreasuryDirect finally dropped the virtual keyboard in the last couple years.
• jessriedel 3y ago
  > In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read all the code to see how this extension works, and what it's [not] doing with your data. The problem is that even if I read the code, or more likely chose to trust that someone has, it's not guaranteed to remain true for future updates. The author's scruples may weaken with time, or they might sell the extension, etc. (I think Chrome's extensions auto-update, but even if they didn't I'd still have to remember that this extension is one that I can't assume it's safe to update.)
  • jdthedisciple 3y ago
    then u can simply clone the repo and locally load the extension ... bye bye auto-updates
  • Hackbraten 3y ago
    That's exactly why I use my system package manager to install and update browser extensions. And whenever the package repository is missing a browser extension I need, I contribute the package and take responsibility for its ongoing vetting and maintenance.
  • mrd3v0 3y ago
    You mean the permissions system is broken and most extensions do suffer from the same issue? Nah mate, we at Google, (bless them Mozilla crooks giving us control over their extensions), don't care about actual issues, we only update extensions to make money and limit user freedom.
  • 1oooqooq 3y ago
    that argument only matters if you're using it on Firefox if you're using it under chrome you're already working under the profit making goal of a failing advertising company. how worse do you think it can get?
  • 3y ago
• js2 3y ago
  For Safari you can get Don't Fuck with Paste (and lots of other Don't Fuck with X options) with the Stop The Madness extension. https://underpassapp.com/StopTheMadness/ https://underpassapp.com/StopTheMadness/
  • stefandesu 3y ago
    Came here to post this. It also works on iOS and on Firefox/Chrome on macOS.
  • lancesells 3y ago
    I was going to mention this but glad I found it. Great extension for Safari. One of the greatest things about this is you can change the options per website. So if you use something like Notion you can use their shortcuts just for their website and the default browser ones for everything else.
  • jiveturkey 3y ago
    ty! I use both safari and chrome (and dabble in FF), and in my safari usage I haven't actually come across sites that disable paste. I kind of assumed this was built-in to safari, but I may just be getting lucky. But the best feature of StopTheMadness is that it defeats the google link tracking! I've so missed that feature of whatever chrome extension I was using.
• kylecordes 3y ago
  I use this similar but even older tool, which still works. This one is Mac-specific but works across most/all apps, i.e. not a browser plugin. https://github.com/EugeneDae/Force-Paste https://github.com/EugeneDae/Force-Paste
• morder 3y ago
  This[1] alternative bookmarklet was posted here a while back. [1]: https://bookmarkl.ink/ashtonmeuser/6e3869d8e468e016f22a4b4de79509bd//no-paste.js https://bookmarkl.ink/ashtonmeuser/6e3869d8e468e016f22a4b4de...
  • dugite-code 3y ago
    Bookmarklets are seriously undervalued. This is a simple and more importantly readable fix for the issue.
    • reticulan 3y ago
      i don't think they're undervalued compared to userscripts (with a dedicated extension for managing them).
      • NewJazz 3y ago
        Wonder if home-manager does user scripts.
    • al_borland 3y ago
      I really wish bookmarklets caught on more. They can provide a lot of the value of extensions, without running all the time and bogging down the browser (or tracking the user around the web). The lack of persistent tracking is probably what led companies like Amazon to abandon them.
    • evgpbfhnr 3y ago
      I wish firefox would let the wonderbar '*' search feature work with bookmarklets... As it stands I have a few I'll never use because they're 4+ clicks away with no typeable shortcut.
      • ringer 3y ago
        You can define a keyword for this, eg. ctrl+l - `ks` (kill sticky) - enter. It has some backwards because you still can't search by name and you have to remember the keyword and there is no auto-complete, but once muscle memory gets used to it, it works pretty well. I use keywords for bang searches (!keyword search term) and bookmarklets too. - https://support.mozilla.org/en-US/kb/bookmarks-firefox#w_how-to-use-keywords-with-bookmarks https://support.mozilla.org/en-US/kb/bookmarks-firefox#w_how...
• nico 3y ago
  Love this Copy and pasting is such an essential part of everyday computer usage Also can relate a bit as a developer, recently been struggling trying to get scrolling paste capture on a remote terminal with ncurses (wide lines, long texts, utf8 characters, can all be tricky)
• freediver 3y ago
  This was one of those things that frustrated me so much that we ended building this natively into Orion browser (Tools menu -> Allow Copy & Paste). [1] One of the joys of building your own browser. [1] https://kagi.com/orion https://kagi.com/orion
  • ghostpepper 3y ago
    How would you rate the security posture of Orion compared to Chrome?
    • freediver 3y ago
      Along what axis?
      • ghostpepper 3y ago
        Size of security team? Mean time to patch actively exploited CVEs? Availability of source? Etc
        • freediver 3y ago
          Same as Safari in that regard, albeit with a much smaller team (we inherit upstream patches from the WebKit team and publish them regularly, sometimes even before Safari like in the case of patching iLeakage vulnerability).
    • torstenvl 3y ago
      Well, there are apparently whole classes of JavaScript malware that Orion blocks but Google doesn't...
      • ghostpepper 3y ago
        This is exactly what I was asking, not sure why my post was downvoted
  • igetspam 3y ago
• Solvency 3y ago
  How about an extension that STOPS websites from NOT letting me right-click. When a site forceS me to go through the stupid Chrome menu to laboriously drill down and find Developer Tools manually I want to throw it out the window.
  • kayodelycaon 3y ago
    There’s a stackoverflow question with some bookmarklets. https://stackoverflow.com/questions/21335136/how-to-re-enable-right-click-so-that-i-can-inspect-html-elements-in-chrome https://stackoverflow.com/questions/21335136/how-to-re-enabl...
• autoexec 3y ago
  You shouldn't need to trust an addon for this, it's something you should be able to set in the browser. In firefox you can toggle dom.event.clipboardevents.enabled
  • coremoff 3y ago
    This used to break google docs copy/paste - haven't tried for a while though, maybe that's fixed
  • amethyst 3y ago
    I wish I could selectively disable only the "paste" events, because it's extremely useful to have "click to copy this value" type of buttons in our various work tools, and I miss the ability to do that every time I try turning off clipboard events to deal with bad actors.
    • themoonisachees 3y ago
      The solution to this is to treat your clipboard as public in the long term. Don't keep sensitive data in it for longer than you need it. KeePass does this and it's great.
      • arboles 3y ago
        Even when your password is erased from the clipboard after 10 seconds, that's enough for any of the tabs open in your browser to steal it.
  • gruez 3y ago
    IME this breaks paste functionality in some web apps (eg. certain terminal emulators or text editors)
    • arp242 3y ago
      The worst is when it breaks web apps in really confusing, weird, and broken ways. Slack, for example. Pasting becomes a complete clusterfuck. Things paste in the wrong location, incompletely, etc. I have no idea how they manage to fuck up "paste in a text box"... Facebook Messenger also broke last time I used it where the tab would start using 100% CPU, but it's been a few years since I last used it, so don't know if that's still the case. Anyway, I really wish I could do this per website. I have it disabled because GitHub started doing weird and annoying shit when I copy/paste stuff from comments and I absolutely hate it. But ... then it breaks Slack :-/
• moralestapia 3y ago
  Thanks for this! Also related, Who t.f. thought that * Ctrl-V should be "paste with format" * Meta-Shift-Whatever-Ctrl-V should be "paste without format" I've never EVER had the need to copy some text and paste it with a different font face, color and ffs background color ... Who is the genius UX expert that decided on this abhorrent behavior?
  • maple3142 3y ago
    Paste with format is actually usefull sometimes. For example, you can copy from vscode and paste into Microsoft Word, then the resulting code will be property formatted and highlighted.
  • Solvency 3y ago
    I guarantee it's the guy who invented rich text fields and he just big dicked the fledgling UX team and because Big Development is incredibly paternal these crappy UX patterns never go away.
  • kayodelycaon 3y ago
    It’s beyond aggravating. I use a clipboard manager (PasteBot on macOS) set to paste plain text by default. I can pop open the history and do command+enter to paste the rich text version.
  • fiddlerwoaroof 3y ago
    I don’t think it’s as simple as this: it’s annoying in the context of text editing, but when you’re dealing with spreadsheets or file managers or copying from an spreadsheet into a document or an image into a document, the rich object behavior makes a lot of sense. I vaguely remember that really old versions of windows had a “live paste” feature where if you copied a range from a spreadsheet and pasted into a word document, the pasted object would update when you changed the spreadsheet
• seiferteric 3y ago
  Also annoying, not labeling your inputs right so auto-fill doesn't work.
• DinaCoder99 3y ago
  I've found you can also just disable javascript, paste, and reenable javascript again.
• lolinder 3y ago
  For something simple like this that doesn't really need to be on all the time I've started leaning back towards bookmarklets over extensions. The code is usually simple enough to actually audit, it only runs when you click the bookmarklet, and it doesn't update underneath you without warning. A few months back someone shared several bookmarklets that they use, one of which was a simple one that disables all clipboard events on the open tab: https://news.ycombinator.com/item?id=38014653 https://news.ycombinator.com/item?id=38014653
  • eviks 3y ago
    But then you need to click Also you can get the extension loaded locally, and it will never update
    • lolinder 3y ago
      I run into one of these broken-clipboard situations once every few months, I can afford to spend an extra click in order to not have an extension active on every website I ever visit.
      • eviks 3y ago
        It "ensure the extension is only running on sites that are bad actors with copy & paste events a", so what exactly can you not afford?
• SubiculumCode 3y ago
  There is one thing I hate more. Its having my cursor moved to another application as I am typing out a password in a field. I've literally had to change a password after it suddenly got sent out in a google search when I wasn't paying attention.
  • eviks 3y ago
    Stealing focus should be a misdemeanor! unfortunately it's a pervasive UI flaw
• dkjaudyeqooe 3y ago
  To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere. If only I could meet the people who make these decisions in person...
  • twobitshifter 3y ago
    Here was a dumb one from me the other day. - I had to use login.gov - My password manager had a saved login for it, I didn’t remember it, but it worked - Then the site asked me for an authenticator app code. I checked my authenticator apps and there was nothing there for login.gov. - There’s a login another way button so I click that and the other way is use the authenticator app! - I click what if I can’t get my code? - It says I must DELETE my account. - I click to delete my account and it sends me an email. - The email says to wait 24 hours for another account deletion email. - 24 hours later I get an email that allows me to delete my account. What was in the account? I have no idea, but it seems that it must be sensitive for some uses of the login. But if it’s sensitive and important why am I able to delete the account, the most destructive thing? Why is an email enough for me to delete it but not enough for me to get an auth code?
    • wccrawford 3y ago
      I would guess that the 24 hour delay is to allow the real owner of the account a change to cancel the delete if someone tries to mess with their account. That said, you're right. This is really weird.
      • erhaetherth 3y ago
        How is the real owner going to know to cancel the delete? Did it send them...an email?
    • m3047 3y ago
      It's been too long and I don't clearly remember, but I think I had to use login.gov to establish an account for mumble. There was an option to print out a onetime pad (for 2FA); I chose it just for kicks. Haven't used it but I have it on file "against the day" I lose my normal second factor.
• mattmaroon 3y ago
  Been using this for awhile. It works.
• datavirtue 3y ago
  I was paying my real estate taxes recently and the payment processor chosen by the county wouldn't let me paste anything. It was fucking bananas. I had to type in bank account numbers and routing numbers. None of the form filling worked. I was paranoid the whole time about entering the wrong data, and I wanted to punch someone in the throat for that bullshit.
• iansinnott 3y ago
  100% in agreement with regaining paste. Another workaround is to create a macro that will "type" the clipboard contents, simulating typing it out by hand. On macOS you can do this via Keyboard Maestro [1]. Create a macro with the action "Insert text by typing" and for the text to insert use `%PastClipboard%0%`. Yes, very niche, but I'm sure some HN users already use Keyboard Maestro. [1]: https://www.keyboardmaestro.com/main/ https://www.keyboardmaestro.com/main/
• drey08 3y ago
  In a similar vain some of the AWS console pages make it hard to select text and use ctrl^c to copy it. It often deselects the text as soon as you hit ctrl. It is extremely irritating.
• BeefWellington 3y ago
  Firefox has some about:config settings for this: * dom.event.clipboardevents.enabled * dom.allow_cut_copy And also, the ability to force a paste as plaintext or force right-clicks to behave properly by using shift.
• deleted 3y ago
  [deleted]
• phyzome 3y ago
  A couple alternative ways to paste, at least in my current Linux environment: - Paste the text somewhere else, then drag it onto the text field - Highlight the text elsewhere, and middle-click on the text field I've only ever found one site that blocks both of those too.
  • aitchnyu 3y ago
    [picks up chunks of brain off the ceiling] Just tried: Bitwarden allows dragging and dropping (hidden) fields into text boxes.
• eviks 3y ago
  At a more general level you can use a keyboard remapping app like Keyboard Maestro on a Mac and Autohotkey on Windows to insert text by simulated typing, though it has the downside of requiring a different shortcut
• 0xfaded 3y ago
  Omg I was being interviewed on coderpad today and something was eating my ctrl-c. So frustrating
• mr-ron 3y ago
  Any time im in this situation i just go to the Menu > Edit > Paste. Usually any overrides are preventing CTRL > V
  • Am4TIfIsER0ppos 3y ago
    A menu? We have no need for such outdated shit in CURRENT YEAR. - Sincerely every browser maker since 2010
• gnyman 3y ago
  Another app/extension which fixes this and a lot of other things the aptly named StopTheMadness https://underpassapp.com/StopTheMadness/ https://underpassapp.com/StopTheMadness/ (No relation other than being a happy user)
• reilly3000 3y ago
  Blame ACH. It’s a putrid protocol that is far easier to get wrong than right. Once that daily file is pushed it’s a dozen people’s time to hope to fix a failed transaction, and there is no guarantee that the money will stay where it wasn’t meant to go. It’s one of those things the leaves you feeling “this needs to be better” yet it moves more money than almost any other means. All the upfront friction on users is to get it right should be some indication of what a catastrophe it is to fix.
  • cubancigar11 3y ago
    Upi fixes it, but has cultural resistance in the west.
    • NavinF 3y ago
      UPI has no buyer protection and it's useless in the west because everyone here has credit cards
• 2d8a875f-39a2-4 3y ago
  Should be more like "don't fuck with anything".
• cyber-nic 3y ago
  Extension for this might be a little overkill. Copy whatever you want to "paste" in the URL bar. Then select that and drag it into the input that has paste prevention.
  • Ringz 3y ago
    What happens with the url? If it’s gone will the form work as intended?
• pjerem 3y ago
  Fucking with past is gruesome. Breaking back button is infuriating. Yesterday I stumbled upon something even worse : breaking CTRL+F to replace it by a custom search. I know Google Docs / Drive does this but I tolerate it because classical ctrl+f doesn’t even make sense on their apps but here it was on a forum. I knew what a searched was on the displayed page but no, they forced me to search on the entire hundreds pages of the topic. [/rant] Sorry.
• afandian 3y ago
  Has anyone else noticed that copy / paste on Mac OS / Firefox has become unreliable some time in the last 5 years? I don’t know if it’s Firefox or Mac OS but I’ve started finding it copied the wrong thing or ignored a copy command.
  • yungporko 3y ago
    pretty sure it's macOS. i don't use firefox but id say roughly 4/10 times i try to paste something i just copied, the clipboard is empty and i have to do the whole thing again.
  • marcosdumay 3y ago
    I've had VirtualBox clipboard integration failing, and I've had Firefox refusing to let sites add things into the clipboard by Javascript. But in my experience, local Crtl-C Ctrl-V is flawless on Linux / used to be X11, now Wayland / KDE / Firefox.
  • NavinF 3y ago
    Your keyboard, or more specifically your Cmd key, is failing
    • afandian 3y ago
      On 2 MBPs and 2 USB keyboards? Unlikely.