Hacker News Reader

Comment by SG- | Hacker News Reader

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

View on HN

Problem is , as far as the browser knows you meant to copy the whole thing.

If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.

Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden.

But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this.

So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way around it.

OCR would work ;-)

Maybe... unless you figure out a trick to manipulate the OCR results with invisible, nearly-white gray areas in the image or so.

So, I know that was a joke, but now I'm trying to figure out why it's a bad idea.

The browser can generate some kind of map for which region of the screen is what font. If you don't have to guess the font, OCR should be easy and reliable. That takes care of the hidden text issue. But second, it means one would be able to copy/paste text that is in an image (because some web designers hate you).

But you don't select text by selecting an area technically, you select a sequence of characters.

You could do a per character visibility test at the time of copying, but sometimes you want to copy test that is not currently visible on your screen.

For example doing Ctrl+A in a document.

Yeah, That's a feature I'd like to have back again.

http://amiga-fish.erkan.se/amiga-fish-disk-968-content-Power...

It's a game of whack a mole, but that doesn't mean it's not a worthwhile game to play.

It strikes that Google probably has some algorithms to detect this. Otherwise black hat SEOers would use this trick to stuff keywords or something.

AFAIK Google fails to penalize you if there is any difference between your background and foreground colors, even if it's 1 unit (e.g. bg #000000 fg #010101). There's always a way around these things :)

The best option I can think of, which is not ideal, is to flash a message of the total copied text. This of course won't be very useful if you're copying a large amount of text but this sort of attack seems to require appending to the beginning of the text which should be easy enough to catch.

The browser knows that the text is not visible, because it is the browser which is not displaying it. Yet the browser is choosing to include it in the copy. Why?

It is displaying it, just in a place your eye doesn't happen to see it due to a load of wonky CSS rules.

You could probably modify your browser to defeat this trick, but doing so you would run the risk of breaking existing sites and making CSS even more complicated than it already is.

And malicious code writers would simply switch up their code to a new trick.

It is rendering it, but not displaying it. The browser knows how wide the view port is, and knows that some of the text sits outside the viewport, so it does not display it. The same check could easily be performed upon OS copy event; it just isn't because the browser authors did not think they needed to.

In this particular case, the characters that get copied are clearly rendered far outside of the area selected by the mouse (in fact, outside the visible area), so I don't see a reason why the browser should think I meant to copy them.

Yes, it's probably not easy to fix, and once fixed there are probably a dozen different ways of cheating. I'm just pointing out that it's certainly possible to fix this particular attack vector.

I often copy things away from my mouse. Consider hitting control-a, or grabbing a region with the mouse and then expanding it with some keyboard navigation. It's very much a non-trivial problem.

There is a good use case for this. For example, if you copy a link from Twitter, you instead get the shortened URL so you're protected from malware when you click through:

https://twitter.com/sampullara/status/320695597894098944

No, they're actually using this trick to do the exact opposite.

If you right click and say 'copy link' you'll get the t.co URL, but if you select the partially rendered URL and ^C you get the full (non-shortened) URL in your clipboard.

Reply on news.ycombinator.com