Comment by inetknght | Hacker News Reader

Comment by inetknght | Hacker News Reader

Parent Full thread

Think it's just the app? Hope you don't have your clipboard events enabled in your browser

Edit for those interested:

tl;dr: "asynchronous clipboard API" [0]

Overtly, it's used by shit news sites like WSJ, nytimes, and bloomberg to inject their shit into your clipboard when you copy-paste. A common thing I've noticed is selecting text, copying the text, and then pasting somewhere and seeing a link to the original article instead.

I'm not sure if they're still doing it; there has been several people complaining about this over time [1] [2] [3] [4] [5] [6]. I found this awesome article on the Security StackExchange from 2013 [8].

Also it's not just javascript. You might be forgiven to think that using a command-line interface would spare you. Unfortunately you'd be wrong; mosh, tmux, vi, emacs all support your terminal emulator's clipboard events. [7] [8]

[0]: https://www.w3.org/TR/clipboard-apis/

[1]: 4 months ago: https://news.ycombinator.com/item?id=22352674

[2]: 4 months ago: https://news.ycombinator.com/item?id=22446940

[3]: 8 months ago: https://news.ycombinator.com/item?id=21377598

[4]: March 2019: https://news.ycombinator.com/item?id=19384895

[5]: December 2017: https://news.ycombinator.com/item?id=16034854

[6]: September 2015: https://news.ycombinator.com/item?id=10301881

[7]: Three months ago: https://news.ycombinator.com/item?id=22815757

[8]: https://security.stackexchange.com/q/39118/47800

To read the clipboard, website needs explicit permission to do so, no way to go unnoticed.

Right. Firefox and Safari (iOS and desktop) haven't implemented the Clipboard.read functionality yet either, only Chrome has and it's only available on use action such as a click or keydown (and not available on touch or scroll events).

But they can copy to your clipboard for you, a lot of services use "Click to copy" features. But reading is much harder.

iOS before 14.0 appears to have allowed apps to read clipboard contents without making that clear to users. Now that you get a notification whenever an app reads the clipboard, it has become fairly clear a lot of apps are reading clipboards constantly. For what… we all wonder.

Can you explain this a bit for me here?

Thanks for the details. I agree that it’s obnoxious for sites to interfere with copy. But they still can’t read from the clipboard, which is the topic here. And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?

> they still can’t read from the clipboard

Incorrect; the API is here [0].

[0]: https://www.w3.org/TR/clipboard-apis/#dom-clipboard-read

It is at least supposed to be hidden behind a permission. What's the default for that permission though? I sure hope Google^H^H^H^H^H^HMicrosoft^H^H^H^H^H^H^H^H^Hsome evildoer doesn't find a way to override your permission setting. A reset of configuration data after an automatic update might do the trick...

> And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?

Perhaps you are right. I won't claim to fully understand how tty programs work. However:

* `emacs` documentation describes an ability to interact with the user's system clipboard [1].

* `tmux` integrates with the user's system clipboard [2].

* `mosh` apparently caches the user's system clipboard [3].

* `vim` has special registers to represent the user's system clipboard [4] [5].

If the system is using dbus (nearly every Linux based OS), it's pretty easy to do. Here's a python script using GTK to do so [6]. A high level overview of the clipboard is described in the freedesktop specification [7].

I think it's really unfortunate that desktop and CLI software is so insecure.

[1]: https://www.gnu.org/software/emacs/manual/html_node/emacs/Cl...

[2]: https://superuser.com/a/1336764

[3]: https://superuser.com/a/1336764

[4]: https://vi.stackexchange.com/a/96

[5]: https://vim.fandom.com/wiki/Accessing_the_system_clipboard

[6]: https://stackoverflow.com/a/21337063/1111557

[7]: https://specifications.freedesktop.org/clipboards-spec/clipb...

Of course there are APIs for accessing the clipboard. I probably use Vim’s clipboard registers 300 times a day. None of this has anything to do with closed source programs reading the clipboard without permission. Speculating that somehow an app might “override your permission setting” is not really informative. There might be any number of exploits.

> None of this has anything to do with closed source programs reading the clipboard without permission.

This has everything to do with closed source programs reading the clipboard without permission since there are no permissions involved in desktop operating systems.

Oh, OK. But all of your examples are open source programs. And there is a reason I only run open source programs on the desktop (except maybe for a driver or two, I guess, possibly). I'm not afraid that Vim is scraping my clipboard and selling the contents to an advertising firm. Because it’s not.

I read something recently that gave the impression browsers didn't allow this and they could only modify the clipboard?

I'm not saying this is true, rather asking if I got the wrong impression.

Reply on news.ycombinator.com