Wtf is that screenshot?! When you're talking about user protection, it generally helps to have a relevant screenshot and not something thats going to confuse or put off users.
Wtf is that screenshot?! When you're talking about user protection, it generally helps to have a relevant screenshot and not something thats going to confuse or put off users.
There's one tiny little problem with the hijack scenario – people only ever paste from the primary selection immediately after selecting something themselves (and thus overwriting whatever was in there). That's precisely because the primary selection is so easy to overwrite (basically when you select anything), so you want to select and then immediately paste so you don't lose it.
So in reality this scenario in which a random page injects something in the primary selection and the user pastes it sometime later in a terminal, of all things, probably has like a million to one chance of occuring.
PS: Also, just for trivia, any user who's been around the console for a while will hit Ctrl+C out of reflex when confronted with unexpected output, not Enter.
PS: Also, just for trivia, any user who's been around the console for a while will hit Ctrl+C out of reflex when confronted with unexpected output, not Enter.
You don’t need to press enter if there’s a new line character in the content.
Both bash and zsh will block until the end of a clipboard input and require an explicit return after it to execute. IIRC this is enabled by default in zsh but can be set for bash. Frankly I'm amazed it isn't the default everywhere.
That doesn't do anything to facilitate the attack, on the contrary. In order for the primary selection to work, the selected text must stay marked as selection until you paste, and everybody who uses primary selection has been conditioned to watch for that selection. If it were to suddenly dissapear you would assume you clicked somewhere by mistake, and attempt to select again, and again. You wouldn't attempt to paste because you've been taught that the selection must hold in order to be able to paste. My next reaction would be to use the regular clipboard instead.
If anything, the script should attempt a longer retry, not a shorter one. A few seconds might be just right to catch someone after they've selected and are moving to the paste window, but before they've pasted the good text. But since the script is looping blindly and has no way to know when to inject, it would have to be a purely coincidental good timing.
I can't imagine that this will manage to succeed very often.
It's a simple POC. To address your points you could easily add an event listener for the window blur event so whenever the window loses focuses. You could also use javascript to manually highlight the user selected text when the window regains focus. You can make it as complex as you wanted.
The point is that the core of the issue, that you can override the users select buffer which could be used to maliciously insert commands, exists.
The Firefox window is not necessarily involved, the user could be copy-pasting between two other windows.
Look, I agree it's annoying and it should be fixed. God knows Firefox is full of dumb little quirks that should have been fixed 10 years ago. But it's not the gruesome attack vector it's made out to be. It is a vector but not a great one, too many planets need to align for anything to happen.
Maybe Firefox needs to add a new "Clipboard access" permission that can be granted on a site-per-site basis. When disabled, simple highlight and copy could still be enabled if hidden text cannot be added in between normal text.
The same permission model could be used system wide, but I do not think that such a feature exists on the X server or Wayland. Maybe using a wrapper that runs before the Desktop Environment?
JavaScript was a mistake.
Not always 🤞. But most sites should be just documents + suggested styling. It really looks good and is super light.
Technical problems created by complicating the web to the point where only one/two companies in the world are able to maintain web browser is not a matter of taste.
JavaScript has created a cross-platform world in which people can do most things without being locked into their OS. That is a good thing.
A world where you cannot access bank, buy a flight ticket, do your taxes or rent a domain name without loading up propietary program on your machine that should be unnessesary.
I'm not against JavaScript as a whole. But those things should not require any additional app, regardles if compiled to assembly and running on Windows or compiled to JavaScript and running in Chrome. Anything above pure HTML should be optional and critical websites (like goverment) should work with scripts or styles disabled.
I don't disagree with that at all. But better that it runs in the browser's sandbox than that you have to install it to your machine which would work only under certain OS.
Case in point, in France we used to do all those things using a minitel terminal (which is about as bright as a VT100) and it worked fine (although at a slow 1200/75 speed).
Of what I've read of Minitel, it was cool, but the kind of thing that simply requires government to mandate it. And also subsidies.
Java applets and Flash applications were fine. Or any random embedded content associated with any random plugin by MIME type. It's a solid, clean, extensible concept.
Instead we have huge monolithic applications.
A friendly reminder that a Java applet could be as nice and functional as any HTML5 webpage, and more. Same with Flash, though it was a proprietary technology.
You could associate embedded content with something other than what someone big intended. Maybe it'd work worse, maybe not, but at least you'd have the option to avoid some particular suspicious thing.
And we had that Web. Yep, browsers had vulnerabilities allowing to pwn you, well, everything still does, or software like Pegasus wouldn't be a thing.
Just in olden days simple crooks, organized crime and governments could pwn you with similar success. In that system simple crooks do the least harm and are the most visible, they keep your sense of danger sharp. And they are the only category that can't that easily pwn you anymore. While the coke&dismemberment types still can, and waterboarding&surveillance types still can.
No, JavaScript clearly was a mistake. But I'm not sure anybody competent could be persuaded of it being a bad idea then. That time of optimism, growing openness of systems and so on.
It was called that because it was a temporary stupidity before they integrate Java applets to browsers in some good, solid way. Which didn't happen, so.
Or maybe my memory betrays me
Xorg is a insecure mess
Webbrowsers even more so.
Not a specific bug. But software who needs patches all few days to fix security holes is per definition insecure.
Every piece of software is insecure, because people make errors and mistakes.
When a law of nature prevents us from doing what we'd want, the right decision is to adapt our approaches.
That would return us back to modularity, Unix philosophy and all such stuff.
Yes, I think Xorg wouldn't survive the filter, but it wouldn't be the only thing.
While this is a real issue, the threat is best mitigated outside of the browser. In theory any application you run could put contents in your primary selection, the threat is what you do with that. The biggest threats I can imagine are insecure shell settings which the author pointed out and can be mitigated easily. Or as a commenter pointed out, cryptocurrency related activities could be at risk - such as pasting in an address to send the currency to could be hijacked and you probably wouldn't even notice as the addresses are random. X is known to be insecure and if you're doing something sensitive like handling cryptocurrency it would be best practice not to run X anyway.
A background service showing what you just copied might work for that, including one that could be set to automatically detect certain exanples of insecure clipboard content (hidden lines, weird Unicode, etc)
Are Chromium browsers affected by this too?
Wow am I glad for my NoScript usage right now. I'm definitely going to be even more restrictive after this.
Thanks! So when using the Firefox or Librewolf or Torbrowser Flatpak, make sure to disable X11 and X11 Fallback!
How does one do this?
Search flatseal on flathub.
In KDE its in the settings
I'm not a web developer: is this a problem on Librewolf? Any settings I should be looking at?
It would be much easier to check the settings for your shell and display server. It's a very niche threat. Think about how having something copied into your clipboard could actually effect you? I can't imagine too many scenarios where you would paste something malicious that would actually be a problem. Paste something malicious into an email and you could just delete it. Paste something into the URL address bar and it wouldn't submit until you told it to. Paste something malicious into your terminal and it wouldn't submit until you hit enter (check that last one yourself).
Alternatively, disable javascript in the browser.
I think there is a way to paste commands into the shell which will run without me pressing the carriage return.
I do disable JS on websites I've never visited before, and the ones I allow to use JS, I attempt to audit the domains that need to run for the website to function.
There are many possible answers, but one far outweighs the rest: Nvidia.
Nvidia and Barrier (or any software KVM). I need something cross platform that can share my keyboard and mouse between my Linux box and the crappy MacBook I'm forced to use for work.
That's Barrier currently but it only works on X11
Wayland is the worst thing that has ever happened to the Unix-like OSs. I'll stick to X til I run out of programs that support it. And then, I'll stick to the TTY and CLI programs.
Wayland is compatible with most X apps through xwayland. If you wanna avoid it then go ahead but pretending it's not viable at all for anything ever is just stupid.
no. my problem with Wayland is that X worked on all POSIX compatible systems. But Wayland is Linux specific. Try running Wayland on Solaris.
Wayland what? Wayland is just a protocol. You need a wayland supporting client. If no ones ported one to solaris then that's not waylands fault. Frankly I question how mature any of those options would be if they did. Seems plasma hasn't had any solaris support for almost a decade, for example. It has migrated to wayland tho.
thanks for using Leebra!
go to feed...
It sort of looks as if they did accept it. If they were hesitant, perhaps it has something to do with the description suggesting that it's a broken and pointless temporary kludge, as well as calling Firefox "removed", and the ridiculously irrelevant screenshot.
I didn't realise it was that easy to build a simple firefox extension like that. Maybe I'll modify it to disable the whole clipboard api and some other stuff.
save