Hacker News Reader

Can't this be used to poison the clipboard with bad code that once pasted in the wrong place will execute?

Just as much as the existing flash-based methods can.

Well I haven't used flash in years.

But Mozilla just re-enabled this exploit and I don't think it can be turned off.

There is a preference to disable the feature: dom.allow_cut_copy

Websites should not be able to overwrite the clipboard unless the action is user-initiated, from the blog post: The execCommand("cut"/"copy") API is only available during a user-triggered callback, such as a click. If you try to call it at a different time, execCommand will return false, meaning that the command failed to execute.

And? That still leaves a website open to doing that sort of thing on a click. (I can see it now: "like <website X> on Facebook today!" or somesuch copied to your clipboard every time you visit a site)

User-initiated != user-approved, at least not unless the user is specifically asked. (Like by, say, prompting allow/allowalways / deny / denyalways)

Reply on news.ycombinator.com