Hacker News Reader

Comment by dylan604 | Hacker News Reader

JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

View on HN

Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo.

It used to be true but all that was fixed like 10 years ago.

I’m curious, how does Google Docs paste from the clipboard when I click the “paste” button from within the Google Docs UI?

Reading from the clipboard is allowed on a user-triggered event.

It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event.

Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

> user-triggered event

“Click Reject All Cookies to exercise your GDPR rights!”

This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.

> Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

Somehow I didn't even realize that's how they were getting around it! I just thought, "Dang, I thought I turned that crap off." Good callout.

The first time you did this your browser asked for a permission via browser's native permission modal

In Safari you get a browser-provided popup menu that just has "Paste" in it when you click on the Google Docs Paste button, it doesn't paste directly

In Firefox it doesn't. When you click, a modal panel appears reminding you of the shortcuts.

Sadly, user interaction does not have to be something done by the user with intent. As another comment below mentions, the code to manipulate the clipboard can be hidden yet still kicked off by the user interacting normally with the website.

Don't know about a repo, but https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A...

How is manipulating clipboard not a problem? What if something replaces your fingerprint or bitcoin address?

An app being able to declare some operations to perform on the clipboard (overwrite, append, etc) that don't return any information about the contents are not a problem from a privacy or security perspective. At most they can be annoying.

If your clipboard contents were overwritten with an arbitrary wallet address immediately before you paste into an exchange's "Send BTC to..." field, that would be a pretty big problem.

I wouldn't expect that most people would double-check to make sure a series of gibberish characters matches what they expect, especially if they don't have any reason to suspect that paste wouldn't output exactly what they copied a moment ago.

Untrue, you can copy sure, but you cannot paste.

If you're using JS to read the clipboard, you don't need to paste. Assume that the purpose of reading the clipboard is not for a useful thing for the user but a nefarious use for the app/site maintainer. The would just send the read data back to their server without the user knowing.

Reply on news.ycombinator.com