News for hackers. Stuff that matters.
Re:Don't Hijack Browser Keyboard Shortcuts by jwr on Wednesday April 09, 2014 @10:25AM (#7559442)
Blogger is notorious for "reimplementing the web experience". Just try opening a Blogger page on an iOS device. You'll get an empty page, then spinning gears, then after a while the page will finally land. Then you'll have a page which won't scroll properly. Because someone just had to reimplement scrolling. Better.

Let's take the horrible Onswipe themes as another example. They not only break functionality and make the page slower, but also break zooming in and show buttons that pretend to be iOS buttons, but aren't.

I could rant about this for hours. It's all the same basic problem: people trying to redefine/hijack basic browsing functionality. I interpret this as extreme hubris ("I know how to design this better!") or arrogance ("this is how you will view my site, period!").

Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:14AM (#7559764)
Urban Dictionary's scrolling was for a while completely and totally broken on my Android phone. I couldn't scroll at all.
Re:Don't Hijack Browser Keyboard Shortcuts by hyperpape on Wednesday April 09, 2014 @09:22AM (#7559074)
The advice of this article is good, but I don't think it should be up to individual website authors to behave well. Ideally, there ought to be a standardized javascript API for binding control keys. Then the browser could prohibit rebinding if desired (while giving feedback to the webapp as to whether rebinding was allowed), and provide an accompanying UI for the user to see which controls are enabled/disabled, to whitelist or blacklist websites, and so on.
Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @10:43AM (#7559560)
Yes please. Especially if it has a single browser option to disable all key rebinding.
Re:Don't Hijack Browser Keyboard Shortcuts by pessimizer on Wednesday April 09, 2014 @09:22AM (#7559071)
One of the dumbest I've run into is to jack ctrl-f and send it to a site search box. If I use ctrl-f, it's because I meant to do an entirely different thing, or by accident. In no case is it because I want to search your article archives.
Re:Don't Hijack Browser Keyboard Shortcuts by dllthomas on Wednesday April 09, 2014 @10:02AM (#7559299)
Likewise slash. I appreciate the nod to vim, but Firefox is already nodding there.
Re:Don't Hijack Browser Keyboard Shortcuts by pessimizer on Wednesday April 09, 2014 @10:53AM (#7559637)
If by nodding, you mean nodding out. For some reason, they've specially crippled the '/' search, and removed the configuration variable to make it identical to ctrl-f (next/last arrows mostly.)

If you happen to read this and are irritated by the same thing: I was saved by "Findbar Tweak." New essential plugin for me.

Re:Don't Hijack Browser Keyboard Shortcuts by dllthomas on Wednesday April 09, 2014 @11:02AM (#7559694)
I've no objection to configurability, but I don't want slash to behave the same as ctrl-f. In particular, when my /-search matches part of a link, hitting return follows the link. Ctrl-f searches for next, which functionality I already have access to with ctrl-g.

Edited to add - how can you stand the lack of next/last arrows in vim?

Re:Don't Hijack Browser Keyboard Shortcuts by emsy on Wednesday April 09, 2014 @09:17AM (#7559042)
Far worse are websites like Battle.net that hijack the onpaste events to prevent pasting passwords. Hijacking keyboard shortcuts may cause inconveniences but prohibiting password pasting is a security flaw.
Re:Don't Hijack Browser Keyboard Shortcuts by chill1 on Wednesday April 09, 2014 @09:56AM (#7559263)
Preventing users from pasting their passwords is quite irritating. I don't even understand the idea behind it. Most likely some developer saw a non-technical user copying/pasting from a plain-text password file, and "had a great idea" to discourage that kind of behavior.

To get around sites that do this, I inspect the HTML and add my password via the value="" attribute on the input element.

Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @10:44AM (#7559568)
I use KeePass' autotype.
Re:Don't Hijack Browser Keyboard Shortcuts by johndoeee on Wednesday April 09, 2014 @09:27AM (#7559094)
I wanted to use a random password, unable to paste it, I pasted it into my firstname field and just typed while reading it from there.

Anyways, I forgot to remove it again so now my first name is <firstname><oldpassword>.

You can't change your name after your account has been created.

Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @10:44AM (#7559567)
KeePass has a great autotype feature that perfectly bypasses that by simulating real keyboard input.

When it comes to anti-clipboard, I really hate sites that make you enter your email address twice (Which is retarded anyway; WHY THE FUCK would I not know/check what I am typing?; it's a cleartext field, you might as well have 2 fields for everything up to first name FFS...), then stop you copying emailfield1 to emailfield2. Fortunately, most still let me click and drag from 1 to 2.

Re:Don't Hijack Browser Keyboard Shortcuts by dllthomas on Wednesday April 09, 2014 @01:45PM (#7560880)
What I really hate is accounting ledgers that make me enter things it two places. Geeeze.

The reason email is special is because if that's wrong there's often no good way to fix it (and certainly no way to notify you). Whether that's sufficient motivation is a matter of judgement, but it's clearly different than first name.

Re:Don't Hijack Browser Keyboard Shortcuts by id on Wednesday April 09, 2014 @09:30AM (#7559107)
PayPal is also doing this in their "change password" form.
Re:Don't Hijack Browser Keyboard Shortcuts by 67726e on Wednesday April 09, 2014 @09:20AM (#7559061)
Do tell, how is that a "security flaw"?
Re:Don't Hijack Browser Keyboard Shortcuts by maxerickson on Wednesday April 09, 2014 @09:30AM (#7559106)
A lot of people that use password managers don't know their passwords (I only know a few of mine). Maybe calling it a flaw is too severe, but it isn't doing those folks any good.
Re:Don't Hijack Browser Keyboard Shortcuts by 67726e on Wednesday April 09, 2014 @11:23AM (#7559829)
I'm curious as to how that would affect a password manager? I was always under the impression that they would directly manipulate the DOM (or perhaps alter the outgoing request)?
Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:29AM (#7559881)
No.

Here is a workflow:

1) Download keypass.

2) generate random password (however you do that...)

3) copy password into web form.

4) copy passwords into keypass and save.

for logging in:

1) open keypass

2) copy password

3) paste into webform.

Typing the passwords leaves room for errors. Truly random passwords are copied and pasted. Words are typed.

Re:Don't Hijack Browser Keyboard Shortcuts by mnutt on Wednesday April 09, 2014 @09:28AM (#7559100)
It could be that some people use password managers that require pasting. (though many don't) It could lead to people using passwords that are easier to remember if their password manager doesn't work.
Re:Don't Hijack Browser Keyboard Shortcuts by dllthomas on Wednesday April 09, 2014 @01:43PM (#7560869)
Hm, this set me wondering how much risk there is passing the passwords through the copy-paste mechanism itself. Probably not terribly much more than passing through the keyboard and IO subsystems, though. Still, I know with X selection buffers, when data is requested the application it's requested from can run arbitrary code to generate (or check!) it and is passed the window-id requesting[0]. It seems like a password manager could make use of this to implement an ACL and lock things down tighter - do any do this?

[0]: http://tronche.com/gui/x/icccm/sec-2.html#s-2.4

Re:Don't Hijack Browser Keyboard Shortcuts by 67726e on Wednesday April 09, 2014 @11:23AM (#7559823)
I guess that is something of a double-edged sword then. You might force someone to use a weaker password, but then hopefully they wouldn't be keeping it in a place where they could simply copy/paste it. This really starts to delve into the whole "security is a gradient with tradeoffs" situation.
Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:33AM (#7559917)
>hopefully they wouldn't be keeping it in a place where they could simply copy/paste it.

???

Passwords can be simple copy/pasted from.

Encrypted files can be simply copy/pasted from.

Re:Don't Hijack Browser Keyboard Shortcuts by 67726e on Wednesday April 09, 2014 @11:39AM (#7559953)
I'm assuming in this scenario that they would be keeping passwords in a plaintext file. If they kept passwords in an encrypted file, wouldn't they need to decrypt it? Wouldn't you presumably have a strong password to decrypt it? Where is that kept? How strong must one's password be when that password is keeping other passwords secure? If they can remember that password, why can they not remember others?
Re:Don't Hijack Browser Keyboard Shortcuts by maxerickson on Wednesday April 09, 2014 @01:36PM (#7560822)
Remembering 1 password is easier than remembering dozens of them. Reusing passwords is not a great idea, so dozens of passwords is a real concern.

It's also the case that disabling paste doesn't do anything to stop a user from storing their passwords in an unencrypted file.

Re:Don't Hijack Browser Keyboard Shortcuts by dllthomas on Wednesday April 09, 2014 @01:39PM (#7560838)
Because remembering one strong password is way easier than remembering 50 strong passwords.
Re:Don't Hijack Browser Keyboard Shortcuts by Fuxy on Wednesday April 09, 2014 @09:59AM (#7559279)
Better yet what's the point of doing that anyway a pasted password is likely to be more complex (read as secure) than a regular one.
Re:Don't Hijack Browser Keyboard Shortcuts by 67726e on Wednesday April 09, 2014 @11:21AM (#7559816)
I simply asked how that constituted a security flaw, but thanks for the snark.
Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:31AM (#7559900)
I saw no snark.
Re:Don't Hijack Browser Keyboard Shortcuts by hyperpape on Wednesday April 09, 2014 @10:23AM (#7559434)
Anything that makes passwords harder to do right without simultaneously blocking some attack worth caring about is bad for security. Two of the biggest problems in security are that it's hard to do things the right way and that people just don't understand it.

Whether you want to call it a "security flaw" is not obviously an important question.

Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:21AM (#7559813)
I am not sure why you are getting downvoted for asking a simple question.

It could be a security flaw because you discourage using passwords that are truly randomly generated.

Re:Don't Hijack Browser Keyboard Shortcuts by 67726e on Wednesday April 09, 2014 @11:25AM (#7559846)
Neither am I...

Wouldn't using a random password and copy/pasting it imply they are storing it somewhere unsafe?

Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:27AM (#7559866)
No. My passwords are stored very safely.

Edited: you were probably downvoted for using scare quotes.

Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @10:47AM (#7559584)
It discourages password manager use.
Re:Don't Hijack Browser Keyboard Shortcuts by 67726e on Wednesday April 09, 2014 @11:20AM (#7559808)
How? Wouldn't a password manager manipulate the DOM directly?
Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @11:22AM (#7559821)
KeePass can use a virtual keyboard to type into stupidly designed fields (no need for DOM), but not all of them. Many use the clipboard to some degree.
Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:36AM (#7559936)
No.
Re:Don't Hijack Browser Keyboard Shortcuts by mwexler on Wednesday April 09, 2014 @09:01AM (#7558965)
Yahoo Mail hijacked the down arrow: Looking in the preview pain, press down arrow to scroll... and you jump to a new mail. Very, very jarring and frustrating. I recall they also hijacked a bunch of other keys, none of which made much sense, which is sad... mostly because it shows that they don't use their own products enough to see how this can affect users.
Re:Don't Hijack Browser Keyboard Shortcuts by npsimons on Wednesday April 09, 2014 @10:30AM (#7559471)
Google+ appears to do the same thing with C-PgUp and C-PgDown; if I had wanted those keys to stop working properly, I would have used some ass-backwards browser like IE. If I've got a Google+ post open and I'm scrolling brisking through tabs, it's like hitting a brick wall.
Re:Don't Hijack Browser Keyboard Shortcuts by valevk on Wednesday April 09, 2014 @09:56AM (#7559265)
Well, I don't think it's a bad idea to have specific shortcuts which disable the normal behaviour of a browser, and improve the UX of a website. If they exists:

* they should be explicitly enabled (i.e. RES for reddit)

* you should be notified if they are changing browser behaviour, and an option to disable shall be provided.

Re:Don't Hijack Browser Keyboard Shortcuts by aestra on Wednesday April 09, 2014 @11:23AM (#7559827)
In practice the only way users are going to discover these "features" is by accident. How would someone be notified the behaviour is changing? The About page nobody reads?
Re:Don't Hijack Browser Keyboard Shortcuts by valevk on Thursday April 10, 2014 @08:25AM (#7565474)
Visual feedback when user executes a short cut.
Re:Don't Hijack Browser Keyboard Shortcuts by choult on Wednesday April 09, 2014 @10:13AM (#7559383)
My personal pet peeve is the hijacking of / for in page search...
Re:Don't Hijack Browser Keyboard Shortcuts by oftenwrong on Wednesday April 09, 2014 @09:26AM (#7559089)
The problem is not that sites are choosing to override browser shortcuts, but that they can do so at all. The browser should not allow its shortcuts to be overridden. In Vimperator you have to enter a pass-through mode, so this kind of overlap never happens.
Re:Don't Hijack Browser Keyboard Shortcuts by 3JPLW on Wednesday April 09, 2014 @10:10AM (#7559357)
I agree. But unfortunately many of the browser creators want to support full-fledged apps within a browser, which in their minds necessitates the rebinding of core shortcuts. A great example is command/control-s in Google Drive Documents.

Conflicting interests.

Re:Don't Hijack Browser Keyboard Shortcuts by dllthomas on Wednesday April 09, 2014 @10:20AM (#7559415)
That's not a conflict, if you're using vimperator. In one mode, you pass whatever. In the other, you pass nothing. The only conflict would be around a site wanting to bind escape...
Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @10:14AM (#7559387)
Agreed.

Is there an addon to block shortcut hijacking? I would love that.

Re:Don't Hijack Browser Keyboard Shortcuts by npsimons on Wednesday April 09, 2014 @10:29AM (#7559462)
Yes, it's called NoScript.
Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @10:42AM (#7559556)
Too many crappy javascript-mandatory websites for that to work all the time, sadly.
Re:Don't Hijack Browser Keyboard Shortcuts by npsimons on Wednesday April 09, 2014 @10:28AM (#7559460)
I’m talking to you, Blogger.

Is this the same Blogger that requires JavaScript to view plain text? Or maybe I'm getting it confused with blogspot, I can never keep them all straight. In any case, I don't think it's a coincidence . . .

Re:Don't Hijack Browser Keyboard Shortcuts by dllthomas on Wednesday April 09, 2014 @10:18AM (#7559409)
This speaks to a broader issue with trying to keep every hotkey at the top level when you have multiple, nested containers. There is a fantastic solution to this: have a leader key that says "I am talking to my browser", where one of the sub-commands is "pass a literal leader key through". This is the way screen/tmux and ratpoison handle key bindings, and it means there is literally zero chance of a collision that I can't trivially resolve by slightly modifying my interaction.
Re:Don't Hijack Browser Keyboard Shortcuts by unexistance on Wednesday April 09, 2014 @08:43AM (#7558898)
it sure is annoying, and let's not mention blogger's hyper-dependencies on javascript in order to display the page. No javascript, no content

anyway, well what can be done is - prompt for user agreement to allow these shortcuts, then save it as user preference / cookie / etc..

Re:Don't Hijack Browser Keyboard Shortcuts by paulojreis on Wednesday April 09, 2014 @10:04AM (#7559322)
Ever tried the "Metro" version of Outlook Web Access, the one used with Office 365? It hijacks "Ctrl/Command + R" as a shortcut to "Reply". How oblivious is this?
Re:Don't Hijack Browser Keyboard Shortcuts by zokier on Wednesday April 09, 2014 @08:48AM (#7558912)
This is just the result of transitioning HTML to an applications framework. Now the application you use to view articles is not your browser, but Blogger (or WP etc).
Re:Don't Hijack Browser Keyboard Shortcuts by waterfowl on Wednesday April 09, 2014 @08:29AM (#7558860)
Yeah this is big to me. Even for system utilities. I use an OS X volume booster called "Boom"(http://www.globaldelight.com/boom/) (which is nonfree but worth the $7) and it, by default, hijacks cmd + +/- for zooming in chrome. Please don't do this!
Re:Don't Hijack Browser Keyboard Shortcuts by threepipeproblm on Wednesday April 09, 2014 @09:18AM (#7559055)
I have noticed issues with Firefox shortcuts while on YouTube, and have wondered if this sort of skulduggery was going on.
Re:Don't Hijack Browser Keyboard Shortcuts by keeperofdakeys on Wednesday April 09, 2014 @08:42AM (#7558896)
Big examples would be PgUp and PgDn in Google+, and (at least on the old design), F5 on Twitter.
Re:Don't Hijack Browser Keyboard Shortcuts by coldpie on Wednesday April 09, 2014 @08:59AM (#7558953)
Google itself hijacks / (forward slash) which I use in Firefox for quick search. Super annoying.
Re:Don't Hijack Browser Keyboard Shortcuts by freestyler on Wednesday April 09, 2014 @09:42AM (#7559178)
I’m talking to you, Stackoverflow. I use Ctrl-k, Ctrl-b quite often.
Re:Don't Hijack Browser Keyboard Shortcuts by Pxtl on Wednesday April 09, 2014 @08:14AM (#7558813)
but what about things like ctrl-s and ctrl-b in Google Docs? Those are handy and I rarely save a page or create a bookmark by hotkey.
Re:Don't Hijack Browser Keyboard Shortcuts by netmare on Wednesday April 09, 2014 @08:42AM (#7558892)
This is an inherent problem with web apps, since they're an app within an app. There are two different contexts fighting each other. Who's to say that Ctrl+S should save the app state or the page? Whatever we choose as the default, the non-default scenario would feel awkward when we need it.

I can think of two ways to solve this: (1) decouple apps from the browser frame or (2) use a special modifier key for app shortcuts (perhaps re-use the Windows key, e.g. Win+Ctrl+S).

Re:Don't Hijack Browser Keyboard Shortcuts by oneeyedpigeon on Wednesday April 09, 2014 @08:53AM (#7558931)
(2) That was attempted (sort of)[1] and it failed pretty badly due to poor browser support and lack of understanding amongst users.

[1] http://en.wikipedia.org/wiki/Access_key

Re:Don't Hijack Browser Keyboard Shortcuts by netmare on Wednesday April 09, 2014 @09:16AM (#7559037)
Yeah, that's pretty messy. As an Opera user I had no idea that other browsers used Ctrl or Alt for access keys. That's just a recipe for disaster. Opera's Shift+Esc combo guaranteed no clashes with browser shortcuts, but it was really kludgy to use.
Re:Don't Hijack Browser Keyboard Shortcuts by oneeyedpigeon on Wednesday April 09, 2014 @08:40AM (#7558886)
See the footnote in the article:

"An exception may be if your site provides specific functionality such as in a drawing application. Even in this case it is best to provide shortcuts as an option the user has to turn on rather than one that is on by default."

Re:Don't Hijack Browser Keyboard Shortcuts by 7schlaefer on Wednesday April 09, 2014 @08:42AM (#7558893)
Yeah. From a usability point of view, I think it's important to hijack some shortcuts, but only those who are not commonly used for such as the one mentioned in the article. I would also argue that this behaviour of blogger is not what users expect, hence it is not a bad behaviour. Wasn't there a pair of shortcuts commomly used for this purpose, Ctrl-K / Ctrl-J if i'm not mistaken?
Re:Don't Hijack Browser Keyboard Shortcuts by qwerta on Wednesday April 09, 2014 @08:42AM (#7558891)
NoScript with whitelist works well enough.
Re:Don't Hijack Browser Keyboard Shortcuts by blueskin_ on Wednesday April 09, 2014 @10:13AM (#7559382)
So fucking true. Obnoxious javascript masturbation pattern #47,601 that will make me blacklist scripts from your site. Same for single-key shortcuts (I'm looking at you there, JIRA...).