2 ms·

To tldr this: 1. It does not allow web pages to read the clipboard (which would be a security violation, and what comes to mind when you say "hijacking"), only

To tldr this: 1. It does not allow web pages to read the clipboard (which would be a security violation, and what comes to mind when you say "hijacking"), only to write to it. 2. Browsers can already trap clicks and keys to override standard copy functionality, so if you're worried about Tynt-style stuff, this doesn't change that equation at all. 3. The only effect of this is that it lets sites overwrite your clipboard when you don't signal that you want to copy something. Which they could already do today if you have Flash. So... at worst, that counts as a minor annoyance. And since most sites aren't actively hostile to their users, it's not likely to be widely-misused, and it's more likely that it'll be used for its intended purpose -- making it easy for users to copy, say, big wodges of code to the clipboard with a single click. The proposed solution to this non-problem would make this feature so cumbersome it might as well not exist, on its way to solving a problem that in practice will almost never be seen.

tbranyen 11y ago
1. The term clipboard hijacking predates my post, so I don't get your point. And yes, if it could access your clipboard that would be insanely insecure. 2. This has nothing to do with overriding standard clipboard functionality. 3. "Due to browser and Flash security restrictions, this clipboard injection can ONLY occur when the user clicks on the invisible Flash movie. A simulated click event from JavaScript will not suffice as this would enable clipboard poisoning." So no, this cannot occur already with Flash. Simply hovering over text is enough with this new API to augment your clipboard. At worst this overrides your clipboard which could contain important information. Visiting a click bait site accidentally could potentially destroy your work (assuming it was in the clipboard). How often do you use this feature already? Would it really make it so cumbersome that you'd never use it. Do you never use location, microphone, full screen, webcam, etc APIs because they ask for permission? I doubt it. I think it's a bit bold and bit too early for you to be making any claims about whether or not this will be abused. I think you have far too much trust in advertisers.
owencm 11y ago
+100
username223 11y ago
> And since most sites aren't actively hostile to their users,... What web are you browsing? Tynt still exists. "Give me your email" popovers exist. Many sites won't display a simple 1000-word article without loading gobs of JavaScript I don't want. Websites are so terrible that most browsers have a "make the content readable" button. Most of the web is actively hostile.
atesti 11y ago
I absolutely don't want this feature and the problem is not that HTML5 is not on par with Flash, but that Flash was able to do it in the first place. Am I the only one who uses and likes click to play for flash? Great way to block clipboard hijacks. And now there is no click to play for html5-clipboard API. There must be a user prompt before a website captures a hover, mousover or EVEN CLICK and decides to overwrite the current code, mail or whatever valuable thing I currently have in my clipboard with advertising links!

tbranyen 11y ago

1. The term clipboard hijacking predates my post, so I don't get your point. And yes, if it could access your clipboard that would be insanely insecure. 2. This has nothing to do with overriding standard clipboard functionality. 3. "Due to browser and Flash security restrictions, this clipboard injection can ONLY occur when the user clicks on the invisible Flash movie. A simulated click event from JavaScript will not suffice as this would enable clipboard poisoning." So no, this cannot occur already with Flash. Simply hovering over text is enough with this new API to augment your clipboard. At worst this overrides your clipboard which could contain important information. Visiting a click bait site accidentally could potentially destroy your work (assuming it was in the clipboard). How often do you use this feature already? Would it really make it so cumbersome that you'd never use it. Do you never use location, microphone, full screen, webcam, etc APIs because they ask for permission? I doubt it. I think it's a bit bold and bit too early for you to be making any claims about whether or not this will be abused. I think you have far too much trust in advertisers.

owencm 11y ago

+100

username223 11y ago

> And since most sites aren't actively hostile to their users,... What web are you browsing? Tynt still exists. "Give me your email" popovers exist. Many sites won't display a simple 1000-word article without loading gobs of JavaScript I don't want. Websites are so terrible that most browsers have a "make the content readable" button. Most of the web is actively hostile.

atesti 11y ago

I absolutely don't want this feature and the problem is not that HTML5 is not on par with Flash, but that Flash was able to do it in the first place. Am I the only one who uses and likes click to play for flash? Great way to block clipboard hijacks. And now there is no click to play for html5-clipboard API. There must be a user prompt before a website captures a hover, mousover or EVEN CLICK and decides to overwrite the current code, mail or whatever valuable thing I currently have in my clipboard with advertising links!