5 ms·
I think the risk is that nefarious people might, for example, wait for you to copy a (legitimate) URL, then overwrite the clipboard with a slightly different UR
by IneffablePigeon 13y ago
I think the risk is that nefarious people might, for example, wait for you to copy a (legitimate) URL, then overwrite the clipboard with a slightly different URL, sending whoever follows what you just copied to somewhere else if you don't notice. Seems to me that this trick would be just as effective at doing that though.
- arsenerei 13y agoWell, yes, but at least you knew you copied something in this circumstance.
- duskwuff 13y agoThere are a bunch of web sites that use an annoying doodad from http://tynt.com http://tynt.com to inject advertising into copy/pasted content. I'm not sure if Tynt is using the exact same trick or not; whatever the case, though, the technique is known.
- dylz 13y agoThey append their spam to the end of the selection, but indexof length -1
- Mahn 13y agoGoogle is doing something very similar to this by the way. On their search results page, if you hover on any link the destination address shown on the bottom part of the browser looks like it'd take you directly there if you clicked, but when you do click, the href of the link is overwritten so the actual link takes you to google.com/?randomvariables&url=http://.. http://... This has always concerned me, not because Google is tracking this, but because this trick could do real harm in the hands of a malicious dev. I mean, who checks the source code of a page to make sure hrefs are not overwritten before clicking a link? PS: I know what you'll suggest, "browser with javascript off then!". No thanks. I spent ~1 year using NoScript on Firefox and I can say I ended up hating it with a passion. It cripples web browsing and makes it a really frustrating experience, and in 70% of the cases you are forced to allow Javascript on the page with its subsequent page reload.