this post was submitted on 14 Sep 2024
1637 points (99.0% liked)

Technology

59282 readers
3996 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 11 points 1 month ago (2 children)

The browser can't access your clipboard contents without permission, but it can place text into the clipboard.

The problem is people the talking the copied text and pasting it into the command prompt.

[–] [email protected] 3 points 1 month ago (1 children)

Yeah that's what I'm curious about; I'm used to copying code snippets or codes from websites by clicking a button (presumably through some browser API?), but am just now realizing that this in itself has security implications.

Using noscript or some such JS blocker would prevent this but break a lot of other things in the process. That's why I'm wondering why the API isn't locked down via some user prompt.

[–] [email protected] 3 points 1 month ago

In Firefox, you can disable the clipboard events. I've done this for the rare case of me copy+pasting a password and forgetting to clear the clipboard after.

On Android, I've noticed that it's possible for apps to read from the clipboard, to read OTP tokens for example. Since I noticed that a while back, I've always been wary of the clipboard on any device I've used.

[–] [email protected] 2 points 1 month ago (1 children)

but it can place text into the clipboard.

Only as the result of a user interaction, for example by pressing a button.

[–] [email protected] 1 points 1 month ago (1 children)

From the Browser's viewpoint, would there be any difference if the webpage has a JS button to put something in the clipboard, or it having code running in the background that puts things into the clipboard at page load?

It's not like there's that much of a difference, as far as the Browser is concerned.

[–] [email protected] 3 points 1 month ago

would there be any difference if the webpage has a JS button to put something in the clipboard, or it having code running in the background that puts things into the clipboard at page load?

Clicking a button shows user intent, whereas a page load doesn't. No user expects loading a page to overwrite their clipboard, but every user that clicks a "Copy to Clipboard" button does expect it.