5 ms·

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that ca

by SG- 14y ago

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

jiggy2011 14y ago
Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.
- crazygringo 14y ago
  Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way around it.
  - gmaslov 14y ago
    OCR would work ;-)
    - LukeShu 14y ago
      So, I know that was a joke, but now I'm trying to figure out why it's a bad idea. The browser can generate some kind of map for which region of the screen is what font. If you don't have to guess the font, OCR should be easy and reliable. That takes care of the hidden text issue. But second, it means one would be able to copy/paste text that is in an image (because some web designers hate you).
      - jiggy2011 14y ago
        But you don't select text by selecting an area technically, you select a sequence of characters. You could do a per character visibility test at the time of copying, but sometimes you want to copy test that is not currently visible on your screen. For example doing Ctrl+A in a document.
    - TheJH_ 14y ago
      Maybe... unless you figure out a trick to manipulate the OCR results with invisible, nearly-white gray areas in the image or so.
    - Lerc 14y ago
      Yeah, That's a feature I'd like to have back again. http://amiga-fish.erkan.se/amiga-fish-disk-968-content-PowerSnap/ http://amiga-fish.erkan.se/amiga-fish-disk-968-content-Power...
  - flogic 14y ago
    It's a game of whack a mole, but that doesn't mean it's not a worthwhile game to play.
  - desas 14y ago
    It strikes that Google probably has some algorithms to detect this. Otherwise black hat SEOers would use this trick to stuff keywords or something.
    - psionski 14y ago
      AFAIK Google fails to penalize you if there is any difference between your background and foreground colors, even if it's 1 unit (e.g. bg #000000 fg #010101). There's always a way around these things :)
  - jaredmcateer 14y ago
    The best option I can think of, which is not ideal, is to flash a message of the total copied text. This of course won't be very useful if you're copying a large amount of text but this sort of attack seems to require appending to the beginning of the text which should be easy enough to catch.
- pekk 14y ago
  The browser knows that the text is not visible, because it is the browser which is not displaying it. Yet the browser is choosing to include it in the copy. Why?
  - jiggy2011 14y ago
    It is displaying it, just in a place your eye doesn't happen to see it due to a load of wonky CSS rules. You could probably modify your browser to defeat this trick, but doing so you would run the risk of breaking existing sites and making CSS even more complicated than it already is. And malicious code writers would simply switch up their code to a new trick.
    - snowwrestler 14y ago
      It is rendering it, but not displaying it. The browser knows how wide the view port is, and knows that some of the text sits outside the viewport, so it does not display it. The same check could easily be performed upon OS copy event; it just isn't because the browser authors did not think they needed to.
- julian37 14y ago
  In this particular case, the characters that get copied are clearly rendered far outside of the area selected by the mouse (in fact, outside the visible area), so I don't see a reason why the browser should think I meant to copy them. Yes, it's probably not easy to fix, and once fixed there are probably a dozen different ways of cheating. I'm just pointing out that it's certainly possible to fix this particular attack vector.
  - dllthomas 14y ago
    I often copy things away from my mouse. Consider hitting control-a, or grabbing a region with the mouse and then expanding it with some keyboard navigation. It's very much a non-trivial problem.
spullara 14y ago
There is a good use case for this. For example, if you copy a link from Twitter, you instead get the shortened URL so you're protected from malware when you click through: https://twitter.com/sampullara/status/320695597894098944 https://twitter.com/sampullara/status/320695597894098944
- robinson-wall 14y ago
  No, they're actually using this trick to do the exact opposite. If you right click and say 'copy link' you'll get the t.co URL, but if you select the partially rendered URL and ^C you get the full (non-shortened) URL in your clipboard.

by SG- 14y ago

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

jiggy2011 14y ago

Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

crazygringo 14y ago
Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way around it.
- gmaslov 14y ago
  OCR would work ;-)
  - LukeShu 14y ago
    So, I know that was a joke, but now I'm trying to figure out why it's a bad idea. The browser can generate some kind of map for which region of the screen is what font. If you don't have to guess the font, OCR should be easy and reliable. That takes care of the hidden text issue. But second, it means one would be able to copy/paste text that is in an image (because some web designers hate you).
    - jiggy2011 14y ago
      But you don't select text by selecting an area technically, you select a sequence of characters. You could do a per character visibility test at the time of copying, but sometimes you want to copy test that is not currently visible on your screen. For example doing Ctrl+A in a document.
  - TheJH_ 14y ago
    Maybe... unless you figure out a trick to manipulate the OCR results with invisible, nearly-white gray areas in the image or so.
  - Lerc 14y ago
    Yeah, That's a feature I'd like to have back again. http://amiga-fish.erkan.se/amiga-fish-disk-968-content-PowerSnap/ http://amiga-fish.erkan.se/amiga-fish-disk-968-content-Power...
- flogic 14y ago
  It's a game of whack a mole, but that doesn't mean it's not a worthwhile game to play.
- desas 14y ago
  It strikes that Google probably has some algorithms to detect this. Otherwise black hat SEOers would use this trick to stuff keywords or something.
  - psionski 14y ago
    AFAIK Google fails to penalize you if there is any difference between your background and foreground colors, even if it's 1 unit (e.g. bg #000000 fg #010101). There's always a way around these things :)
- jaredmcateer 14y ago
  The best option I can think of, which is not ideal, is to flash a message of the total copied text. This of course won't be very useful if you're copying a large amount of text but this sort of attack seems to require appending to the beginning of the text which should be easy enough to catch.
pekk 14y ago
The browser knows that the text is not visible, because it is the browser which is not displaying it. Yet the browser is choosing to include it in the copy. Why?
- jiggy2011 14y ago
  It is displaying it, just in a place your eye doesn't happen to see it due to a load of wonky CSS rules. You could probably modify your browser to defeat this trick, but doing so you would run the risk of breaking existing sites and making CSS even more complicated than it already is. And malicious code writers would simply switch up their code to a new trick.
  - snowwrestler 14y ago
    It is rendering it, but not displaying it. The browser knows how wide the view port is, and knows that some of the text sits outside the viewport, so it does not display it. The same check could easily be performed upon OS copy event; it just isn't because the browser authors did not think they needed to.
julian37 14y ago
In this particular case, the characters that get copied are clearly rendered far outside of the area selected by the mouse (in fact, outside the visible area), so I don't see a reason why the browser should think I meant to copy them. Yes, it's probably not easy to fix, and once fixed there are probably a dozen different ways of cheating. I'm just pointing out that it's certainly possible to fix this particular attack vector.
- dllthomas 14y ago
  I often copy things away from my mouse. Consider hitting control-a, or grabbing a region with the mouse and then expanding it with some keyboard navigation. It's very much a non-trivial problem.

spullara 14y ago

There is a good use case for this. For example, if you copy a link from Twitter, you instead get the shortened URL so you're protected from malware when you click through: https://twitter.com/sampullara/status/320695597894098944 https://twitter.com/sampullara/status/320695597894098944

robinson-wall 14y ago
No, they're actually using this trick to do the exact opposite. If you right click and say 'copy link' you'll get the t.co URL, but if you select the partially rendered URL and ^C you get the full (non-shortened) URL in your clipboard.