Hacker News Reader

Comment by rhn_mk1 | Hacker News Reader

I find the reasons not to mitigate this in any way short-sighted.

Disabling the copying of invisible text will not mitigate all the instances. Disabling the modification via clipboard events won't either. Nor will disabling the ability to see user's selection.

But each of them would cut off a lot of offenders already (defense in depth-like), and each change in this direction would give credibility to the idea that the expected behaviour is to copy what's visible. With all of them implemented, it would become politically much more palatable to plug the last holes and let copy-paste behave 100% as users expect.

View on HN

I think your suggestion would actually make things worse, because it would cause more people to have a false sense of security when copying from a web browser, which is exactly the problem in the first place.

The issue is not that the clipboard can be modified. The issue is that users expect a clean copy when they copy from a website.

There are many valid uses for this, and there is not a strong enough argument that this presents a real security issue that would necessitate disabling such a widely-used feature.

I don't think security is the only factor here. Security is only achieved when 100% of the holes are plugged, which is indeed not achievable outright.

But what is achievable immediately is being closer to user's expectations of what will be pasted in general, and a step-by-step approach gives benefits in this regard at every step, without making false promises.

Ok. So you're editing a sheet on google docs, you highlight part of it to copy into another doc. You hit ctrl+c.

What happens?

Do we not let Google modify what you just copied to inject the actual rich-text version of what you highlighted, as opposed to the presentation-formatted version you're seeing as a user in the editor UI?

What can actually be done if we allow the 'good actors' to continue working as needed?

Let's handle this like we handle things like location tracking, notifications, etc: ask the user.

Except I don't think we should ask the user, because everyone will blindly click yes. I think we should disable this by default, and let Google Docs, etc., remind the user via some in-app modal with step-by-step instructions.

If someone actually needs this functionality, let them do the work to unlock it for a given website.

99.99999% of the web has no good reason to be modifying a user's clipboard.

I encourage you to read through the OP first on why your suggestion (remove copy-modification entirely) is not reasonable.

Ah:

> The metro.co.uk code inserts an off-screen-positioned element with the disclaimer into the selection range, and you could just listen for selectionchange and/or mouse drag and/or keypress events to detect selection changes, and add/remove such an element based on those events.

Well, shit.

My favorite scummy thing done to mess with browsers is to insert a noscript meta refresh redirect just to catch anyone who refuses to run the JavaScript adware embedded in their crappy local news website CMS. It must be standard in some local newspaper CMS and I've only ever seen it used on that sort of site.

Never underestimate newspaper publishers' CMS vendors' ingenuity.

Idon't know what the "correct" solution for that could be. I can come up with some half-baked ideas, like whitelisting, web-app bifurcation (we have reader mode, why not app mode?), or allowing for some amount of modification if clipboard events are enabled.

What's clear to me is that the situation we have now is suboptimal, that coming up with a better solution will take up some time, and that incrementally fixing the current situaton completely will take enough time to find a better solution in the meantime.

> Do we not let Google modify what you just copied to inject the actual rich-text version of what you highlighted, as opposed to the presentation-formatted version you're seeing as a user in the editor UI?

could you not have a two tiered clipboard that is exposed via javascript for the webpage interactions(to solve the copy and paste issue with rich text inside google docs) but have the main paste system be synced with the system clipboard and that restricts the copy and paste to visible text/non-javascript hijackable(stops the manipulation of the clipboard to inject malicious code for terminals or even the annoying injection of "this snippet was copied from example.com/xyz")

I haven't thought too hard about the downsides to this or how hard it would be to implement but i'd be curious to see any discussion on some kind of approach like this.

Isn't this just a rehash of the "people ride their bicycle more dangerously when they're wearing helmets" argument?

The solution is all of the above, and also don't paste stuff into your terminal from the internet.

> also don't paste stuff into your terminal from the internet.

Or at least use a shell or terminal that handles pasted newlines gracefully.

…or use bash's `edit-and-execute-command` feature (`C-x C-e` or `ESC v` in vi mode).

I respect and share your goal to educate users about what they should expect from their browser/computer security-wise.

As someone with a (healthy?) distrust of the content I copy/paste, and would never run code I copy/pasted without checking it first (one of the examples given in the linked bug report thread), I would still rather my browser only copy the text that I visibly highlighted. It is annoying to edit content out that I have carefully selected.

>I would still rather my browser only copy the text that I visibly highlighted. It is annoying to edit content out that I have carefully selected.

Absolutely. But how do we solve that problem and still allow proper usage of it? Removing this feature would break the copy ability of nearly every rich-text-like web-based UI in existence, such as Google Sheets.

Personally, this feels more like something for an adblock-like addon.

The 10 sites that have a genuine reason to listen to selection events and force you to copy invisible text can ask permission to do so, as suggested in the thread.

That still does not answer the question of "what are we asking permission for?"

Why that is a hard question can be understood by reading through the discussions in the OP.

> Removing this feature would break the copy ability of nearly every rich-text-like web-based UI in existence, such as Google Sheets.

Skipping over the technical implementation issues, I'd rather copying rich-text-like be relegated to a "Copy Rich Content" context menu action, and the default copy command be plain text only.

I very seldom want to copy rich content. I very frequently am copy/pasting content to notepad, selecting it, and then copying it again in order to strip out the rich content I don't want.

I'd agree with you if the proposed fixes were "freebies." But they're not, far from it.

Each proposed fix breaks a substantial number of websites, and you're breaking tons of websites for something you know can be trivially bypassed from the get-go.

There's certain times/reasons to break a tons of sites. SameSite being one of them. Mandating Https across resources was another. This group of hacks that don't really fix the core issue, is definitely not one of those times.

If someone can legit fix it, it might be worth some breakage, but the fix has to be far better than the proposals here (and to be honest I don't think it is actually possible to fix, a simple font can undo any amount of work).

> Each proposed fix breaks a substantial number of websites, and you're breaking tons of websites for something you know can be trivially bypassed from the get-go.

Which websites? Do you have specific examples?

If your website functionality is critically dependent on manipulating my clipboard in ways I can neither predict nor expect, then I'd argue your website is broken by design and should be burned to the ground and rebuilt from scratch.

The only legitimate use of this I can think of is a "click here to copy this text to your clipboard" type of button, and I'd hardly count that as a critical feature (hell, more often than not it just gets in the way).

> Which websites? Do you have specific examples?

The link contains specific examples. But Microsoft's entire suite of Office 365 online applications is another example.

> critically dependent on manipulating my clipboard

They're manipulating their own content before populating your clipboard request. There's a stark difference. If you turn off the clipboard interception (there's several extensions that do just that) you'll often get garbage out instead (e.g. raw HTML, gibberish, etc).

But don't take my word for this, install one of those extensions and never opt out of any sites. You'll get roughly the experience you're asking for, including the broken ones.

> If you turn off the clipboard interception (there's several extensions that do just that) you'll often get garbage out instead (e.g. raw HTML, gibberish, etc).

One of the proposed fixes (only copy visible text) would fix this, not cause it to spontaneously happen.

Not that it should be happening in the first place. If your site is abusing HTML to such a degree that the browser can't figure out on its own whether or not some text should be included when copying to the clipboard, and that you therefore feel the need to pull some insane switcheroo to get the "right" data into the clipboard, then that is the exact sort of site that ought to be burned to the ground and redesigned from scratch per my previous comment. That strongly indicates an extraordinarily-broken design.

And yes, Google Docs and Office 365 would be included in that category of "burn it to the ground, salt the earth upon which it stood, and rethink its design in its entirety" if they were really that defectively-designed. Thankfully...

> But don't take my word for this, install one of those extensions and never opt out of any sites.

I already have (or more precisely: I set "dom.event.clipboardevents.enabled" to false in Firefox's about:config page), and just tried copying and pasting in Office 365. Word works without any issue whatsoever (except for a loss of formatting). Excel won't let me copy and paste cells, but if I double-click into a cell, copy the text, double-click into another cell, and paste, I get the same text (with default formatting). Similar deal for PowerPoint; it won't let me copy the text boxes themselves, but I can copy the text inside them and paste that text elsewhere.

If I were to fix O365 in this scenario, I'd probably opt to use JS to detect the CTRL-C and CTRL-V keystrokes and maintain an application-specific internal clipboard specifically for these rich objects (cells in Excel, text boxes in PowerPoint, etc.); they're unlikely to be wanted outside of those applications, so no need to put anything in the real clipboard (besides what the browser thinks should go in it by default, if anything). The only thing that'd still be broken is any kind of text fallback (if one even exists).

The only copy visible fix was afaik reject in the bug tracker because you could switch the visibility on and off for a short time (<1s).

The don't allow changes to selection would mean if you mark something on a website and use a button to change it (change to a link for example) you can't do that anymore.

The proposed fix would be either easily circumvented or/and would mean a high risk of breaking working sites.

If you read the bug section the last comment explains why the proposed fixe are a bad idea.

> The proposed fix would be either easily circumvented or/and would mean a high risk of breaking working sites.

It wouldn't be harder to circumvent if changing the text (including the visibility thereof) between the start and end of the selection caused an automatic deselection. It shouldn't break any sites, either, unless those sites are doing fishy things or are already poorly designed (which - again - would warrant the torches and salt).

Sorry for the late reply.

That would mean the following would not work:

selecting text-->making it bold(via button)-->making it underlined(via button)-->making it to a link(via button).

There are valid use cases for selections and manipulations.

I think the only way to work against such a thing would be to display the selected text in a tooltip like window, like another user described.

The web app could maintain its own start and end points for the selection (independent of what the browser deems "selected") and apply those operations to the text within that internally-defined range.

None of those things affect visibility, though, nor do they change the actual content (just the styling/appearance), so the "deselect on visibility or content change" approach wouldn't impact that at all anyway.

Reply on news.ycombinator.com