News for hackers. Stuff that matters.

A comment on Chrome allows websites to write to the clipboard without the user’s permission. Parent comment

Re:Chrome allows websites to write to the clipboard without ... by userbinator on Saturday August 27, 2022 @03:24AM (#32616661)
Why do you call it a "user gesture" and not "consent" as it should absolutely be? Is it to reinforce the notion that users' actions are only to be taken as mere suggestions and ignored if they are contrary to your goals?
[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by samwillis on Saturday August 27, 2022 @04:13AM (#32616926)
"user gesture" and "consent" are two completely different things.

Currently (until this bug) it’s supposed to trace back the call stack to the event that triggered it, and only allow it if the triggering event is something like a click. That’s what’s meant by “user gesture”, the opposite of code triggering it independently of the user.

“Consent” would be a positive acceptance in a browser controlled message box asking for permission to use the clipboard.

Most people agree that for copying to the clipboard the first is all that’s needed (there isn’t really a security concern here), for pasting from the clipboard the later is always required.

[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by userbinator on Saturday August 27, 2022 @06:01AM (#32617441)
there isn’t really a security concern here

See the other discussion here: https://news.ycombinator.com/item?id=32614839

[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by samwillis on Saturday August 27, 2022 @06:47AM (#32617651)
Ok, so there is a related vector here, but it requires the site your are on to be compromised.

I would argue the actual vector is in the terminal, it should really validate the clipboard content.

[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by PoignardAzur on Saturday August 27, 2022 @04:04AM (#32616874)
> Is it to reinforce the notion that users' actions are only to be taken as mere suggestions and ignored if they are contrary to your goals?

Wow, rude.

One possible answer to your question: there is no way for a browser to detect "consent", which is a subtle and nuanced concept, but user gestures have a hard and fast definition, so that's the proxy they use.

[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by ndriscoll on Saturday August 27, 2022 @10:18AM (#32619300)
When a site wants access to my camera or microphone, the browser detects my consent by asking me. I don't see why listening to clipboard events shouldn't be treated in the same way. Likewise with mouse and keyboard tracking events.

The number of sites that reasonably need to know when I copy/paste or need to override what happens when I do that is approximately zero. There's no reason to allow it by default for all sites.

[ Parent | on HN ]