Clipboard Data Theft Now Optional With IE7 162
An anonymous reader writes "It's been known for a long time that Internet Explorer will happily allow any Web site to steal data that users have recently cut-and-pasted or copied into the Windows 'clipboard' data storage area. Well, now it looks like Microsoft has finally decided that this 'feature' was probably ill-advised, according to The Washington Post's Security Fix blog. IE7 throws up a warning asking whether users really want to let a site filch their clipboard data (Firefox, Opera and most other non-IE browsers forbid this behavior by default)."
not quite (Score:5, Insightful)
No, they don't forbid. They DON'T IMPLEMENT such a stupid idea. Microsoft had to go out of their way to ADD this "feature".
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Informative)
signed.applets.codebase_principal_support Gives scripts using codebase principals access advanced scripting capabilities. Basically, it allows signed applets out of the sandbox because they've promised to play nice. One of the main uses of this (according to the help page) is to allow IRC applications access to your clipboard.
http://kb.mozillazine.org/Firef [mozillazine.org]
Re: (Score:3, Informative)
Being able to highlight something, then middle click to paste it somewhere is huge.
You still have a separate ctrl-c and ctrl-v functionality with a separate clipboard for your manual copy/paste, so you're not losing any functionality.
It's a *very* useful feature, and far from useless, I keep looking for something similiar for windows but can't find anything that works for me.
Re: (Score:3, Informative)
Re: (Score:2, Funny)
Re: (Score:2)
I first became aware of this particular one when mkaply filed bug 360950 [mozilla.org], and I've been trying to figure out how to incorporate it into Security tips for Firefox users [squarefree.com].
Re: (Score:2)
Well no, because (thank God) Flash is not installed by default. Also, this security bug in Flash. Plugins have just as much control over your computer as Firefox does (this is how it works with any browser) and it is up to the plugin's authors to keep their plugin secure. Macromedia/Adobe have failed but they probably couldn't care less. That's why plugin
Re:not quite (Score:5, Informative)
Don't know about the others, but firefox definitely does implement it [mozillazine.org], it's just off by default.
Re:not quite (Score:5, Insightful)
- Whoah, you can't copy paste unless you manually do CTRL-V, or CTRL-X/C
I gave up on using word/openoffice I simply use writely for all my documents. I've had documents being edited with up to 50 people just fine.
Think twice before blindly bashing microsoft. There are some of us that want that "feature"
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Still, IE7's way does seem better in this case.
Re:not quite (Score:4, Informative)
It seemed like a good idea at the time (Score:5, Funny)
MS: It seemed like a good idea at the time.
Public: In what way did it seem like a good idea?
MS: Well, maybe not a good idea, but an idea.
Public: So thinking was involved.
MS: Well, it was more like inspiration.
Public: ...
MS: They throw chairs at us. Help. Please.
Re: (Score:2)
MS: They throw chairs at us. Help. Please.
Funny, I always thought it M$ that threw chairs [google.com].
Re: (Score:2)
Yay, new Firefox users! (Score:3, Insightful)
My god, I don't know how I've missed this one. It's the most scary thing I've seen in a long time. I like to think I'm pretty savvy, and I stay up with all of the latest scoop, but this is the first I've read about this gaping security hole.
For the past half hour, I've been showing people I work with this exploit (I'm sorry, I refuse to call it a "feature"), and everyone's been forwarding e-mails to their home account with two pieces of information: 1) The ScriptingMagic site URL to play with at home an
Re: (Score:2)
- http://dictionairy.com/ [dictionairy.com]
- Accorddingly
- insufficient
- electrolisis
- dyode
- http://funnylink.com/ [funnylink.com]
- [Random business address]
- Hey I'm back from vacation, what's up guys?
- xnYZ36A
- In a world savaged by insecurity one man is standing up to stop it.
- Eva Longoria
- ASDF
- http://business.link.com/ [link.com]
I'm quivering in my boots as I write it. My god! They know everything!
Re: (Score:3, Insightful)
Well, Firefox does [mozillazine.org], although it's off by default and requires a site to be whitelisted. Globally allowing silent access to the clipboard is shockingly bad, though, even if in the vast majority of cases the contents will be perfectly benign; it speaks volumes about the general attitude towards security.
Re: (Score:2)
The "feature" in question is the following JavaScript snippet:
Firefox throws an exception "Access to XPConnect service denied" and Opera 9 claims no support (throwing "NOT_SUPPORTED_ERR"). 'copy' and 'cut' throw similar exceptions.
So, yes, Mozilla DOES IMPLEMENT this "stupi
Features vs. Security (Score:5, Insightful)
Microsoft (and other software companies, but MS gets the most attention for it) spent years working under the paradigm where making things more convenient and/or more powerful for the user was the most important thing you could do to get people to use and buy your product. (Not saying they succeeded at making things convenient, just that it was the goal.) Security was only rarely a concern, because for the most part an attacker (barring the occasional virus-infected floppy) needed physical access to a personal computer to mess with it.
Two things changed: personal computers are now vastly interconnected. Lots more people have them. Result? Bad guys can attack random machines on the other side of the planet using automated tools. Security is now a major priority.
Bolting security onto insecure-by-design products has had spotty success. In the last couple of years Microsoft has also tried to make more security-conscious designs...and they've paid for it in complaints when customers lose the convenience of, for example, always running with admin rights.
Re:Features vs. Security (Score:5, Insightful)
Re:Features vs. Security (Score:5, Insightful)
IE has been around for a decade. It took until people started massively taking advantage of the security flaws in Windows, IE, Outlook (Express) -- the outbreak of worms and viruses a few years ago -- for Microsoft to adjust to the fact that security was not just something to consider, but might possibly trump the old priorities.
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Plus they also tried to turn IE into a platform for intranet applications that *require* more access to the machine than they should have from within a browser.
You're not kidding. The place where I work has many intranet applications that require IE use, and also require that you eliminate just about every security mechanism that IE has in order for them to work. Siebel is the biggest offender. You practically have to mount a "please hack me" sign on your workstation after you set up IE to make Siebel wo
Re: (Score:3, Insightful)
Why would one write a web application that works only in Internet Explorer? Doesn't that defeat the primary benefit of a web app - increased flexibility? Wouldn't it be more sane to use something like VB that will be more consistent at the expense of less portability?
Re:Features vs. Security (Score:5, Interesting)
Don't forget that that includes UNIX; from the preface to O'Reilly's "Practical Unix and Internet Security" [unix.org.ua]:
The various flavours of UNIX have come a long, long way since 1991. So have MS; but they have had farther to go, started later and have not been travelling nearly as fast. A modern Windows PC in skilled/sensible hands is safe enough, but so many are in less than optimal hands...
Re: (Score:2, Interesting)
Re: (Score:2)
In fact, lets remember that the first Internet worm [wikipedia.org], that could have brought down the whole Internet (a small network at that time), infected Unix systems and was 100% UNIX-based and used a fscking buffer overflow vulnerability. Still today there're tons of those buffer overflow vulnerabilities.
Re:Features vs. Security (Score:4, Insightful)
Yes, and that worm and others like it are the primary reason that sendmail only makes up about half of all the mail servers out there (50-60%, depending on whose numbers you believe). You can't call that a security hole in UNIX any more than you can call an IIS security hole a flaw in Windows XP Pro.
Re:Features vs. Security (Score:4, Insightful)
I don't disagree with you at all, but I'm compelled to add this:
The thing is, computers are ubiquitous -- and omnipresent -- these days, and the bulk of them are running MS Windows of some version. They're as common as stereos, but as touchy as a Stradivarius (or a crappy Strad copy). It's not really a valid assumption that all computer users are experts at using computers. They buy them to shop, do embroidery, type phone lists into spreadsheets, watch porn, keep in touch with relatives, etc. They don't want to be computer experts in order to do these things any more than I want to learn to play bass or drums or violin just to listen to some music.
So if Microsoft wants ordinary people to be able to continue using Windows PCs in a networked world, security has got to be easier. If the only secure computer is one that is managed by an IT Pro, then the potential market for personal computers (and PC operating systems) is only businesses. And that would be bad news for MS.
Just curious here (Score:2)
kids today (Score:4, Insightful)
The various IBM mainframe OS choices?
OS/400?
There were a zillion wierd mini architectures/OS combos you could buy in 1991.
Re: (Score:2, Interesting)
VMS, OS360.
Re: (Score:2)
Re: (Score:3, Informative)
I think it's more acurate to say "appear convenient and powerful". There's nothing convient or powerful about data lost or computers infected with worms and trojans.
Re: (Score:2)
IE is integrated with the GUI itself, so it's bound to have some extra "functionality" like this.
IE is no more "integrated" into the Windows "GUI" than, say, khtml is into KDE.
Re:not quite (Score:5, Funny)
Re: (Score:2)
Re:not quite (Score:4, Insightful)
Yes. I do a significant amount of my testing in Opera 9 and Firefox, and am in fact developing a full-featured RTE based on designMode that currently works in IE, Firefox, Opera 9, and Safari 2.
It reads like a troll, since you clearly haven't done much testing with Opera 9. Their DOM implementation is complete through most of level 2, and is in line with Firefox 2. Their new designMode stuff is very complete, with behavior similar to Firefox's Midas. The XMLHTTPRequest stuff that everyone relies on so much now has been well-supported for a very long time.
The reason Opera doesn't work on so many "AJAXy" applications is, simply, because of the fact that developers with your mentality either do sniffing of the navigator object (which is Wrong, a Bad Thing, bad practise, and just plain idiotic) or are just too shortsighted to see that Opera is improving with every new release (version 8.0 notwithstanding).
I do the bulk of my Javascript testing now in Firefox, but use Opera 9 as a test environment to verify results. I test in IE only to see what other kinds of idiotic things its half-assed "DOM" implementation does wrong.
Re: (Score:2)
Re: (Score:2)
Probably? (Score:5, Insightful)
This is beyond complete stupidity. I probably can't even count the number of times I've had security sensitive stuff in the clipboard.
Re: (Score:2)
It's probably NEVER a good idea to keep sensitive data in the clipboard. You never know when that particular chunk of memory might get swapped out to disk. When that happens, your "secure" data is now sitting in plaintext form inside your swap file. Secure data really needs to be handled only by secure applications (with appropriate memory pins to prevent sensitive data from going out to an unencrypted volume). The clipboard is definitely not something I'd consider for that purpose.
I've grepped for my ema
Re:Probably? (Score:4, Funny)
Re: (Score:3, Informative)
You're worried that if someone steals your laptop, they might be able to find your email address and spam you?
First of all, I said email PASSWORD, not address. Somebody could steal my laptop and read my email and send email from my account. That would require them to be able to discern the password in all the millions of bytes of swap data, but I can imagine writing a program that could scan for candidates.
If my email password happened to be equal to my main account password (as can happen due to cert
Re: (Score:2)
But more seriously...
I think it's pretty hard for applications to manipulate data (even passwords) in a way that guarantees they are never written to a swap file. And that's assuming your computer is *off* when it's stolen; it takes even more care to ensure the data doesn't remain in memory.
If you're paranoid enough to want to protect that data, though, why not encrypt your entire user acco
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I don't think you can do that in windows.
You can, but it's ill-advised. The Windows VM system is tuned with with assumption a pagefile will exist.
Never used swap on my audio workstation (only 1G of memory), but I have 2 G in my windows machine and It still uses the pagefile.
Windows will always page out while the system is idle - this is generally A Good Thing, as it allows any new (or additional) memory allocations to be serviced immediately (simply by marking the already paged-out RAM as free), rathe
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Could anyone explain.. (Score:2, Interesting)
Re: (Score:2)
"Oh... we uhh.. put in a huge security hole?? Whoopsiedoodle!! Tee hee hee...Sorry."
Thank God! (Score:2)
Thanks MS!
Can't Believe It (Score:3, Insightful)
Re: (Score:2)
Where's Clippy when you need him? (Score:3, Funny)
"It looks like h4XX0R5.net would like to see what's on your clipboard."
I'm helping! (Score:5, Funny)
Send personal data to unknown source? Click Ok to continue.
Why? (Score:3, Insightful)
[new phishing scam]
Open text document, type in password, copy the password to clipboard, click this link, and we'll verify that your password matches the one in our file. Honest!
Re: (Score:3, Interesting)
I still can't see a good reason to let the web page automatically get clipboard data. If you need it that badly, throw up a text box, and have the user hit paste.
Re: (Score:2)
Re: (Score:2)
I'm sorry, but allowing global write access to my clipboard is also multiple types of insane:
Clobbering my clipboard destroys whatever information I had on it. Given that my system does not habitually destroy that for no good reason, sometimes that's unique information that I don't have anywhere else. I don't want it poofed by some web site being "helpful".
Clobbering my clipboard ensures that the next time I paste, something different will happen than what I expected. Obviously this can be leveraged into th
Re: (Score:2)
Re: (Score:3, Insightful)
It's the defaults, stupid (Score:2, Interesting)
I've said it before, and I'll say it again: half of MS's security problems are stupid defaults. You've been able to disable "allow paste from script" in IE for ages now, but it's ENABLED BY DEFAULT. Stupid, STUPID, STUPID!!!
Now, if they would just unhide extensions by default, and disable ActiveX by default except for pages on the trusted list (or just get rid of ActiveX totally, but I realize that'd be asking for too much), and get rid of a few other stupid defaults that I always uncheck on a new inst
Are both ways fixed? (Score:5, Insightful)
- Via the javascript windows.clipboard object.
- You embed an active-x spreadsheet in your page (which gets installed with office) then java script can call a method to paste the contents of the clipboard into a cell in the spreadsheet.
Anyone know if both methods are now fixed? The Washington Post article doesn't seem to say.Re:Are both ways fixed? (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Only a matter of time... (Score:2, Informative)
Yes, it's possible to disable it completely through Internet Security Settings with a setting called "Programatic Clipboard Access".
There are many clipboards but this one is mine (Score:3, Funny)
p
Re: (Score:2)
Indeed. That's the only clipboard I trust and rely on.
:wq!
WoW login stealing method? (Score:2)
Re: (Score:2)
Once Again, "It Isn't a Bug, It Is a Feature!" (Score:3, Insightful)
So instead of fixing the bug, they treat it like a feature and ask for confirmation. This behavior by default should never be allowed in any context let alone a web/internet one. Asking for user confirmation on an action not allowed is silly and yet another scary dialog where the user won't bother reading or understanding the warning and just click "Yes" to dismiss and continue on their browsing.
I hate sounding negative when talking about Microsoft's technology but it is stances like this that make it so hard to avoid.
Re: (Score:3, Insightful)
Actually, what's sad is that this *really was a feature*! A bug implies unintended behaviour. But clearly, they *meant* it to work this way.
Re: (Score:2)
Usually, the site wants to offer an alternate user interface for the Paste command.
The most common example is a WYSIWYG editing box with a 'B' button, an 'I', button, etc. Maybe they think users expect Cut/Copy/Paste buttons on any toolbar that includes text-styling commands, and won't think to use th
Re: (Score:2, Insightful)
Re: (Score:2)
I mean, how much time it took you the first time you added a dialog and two buttons to a program? It's understable that it took them 3-4 years to implement and test!
Re: (Score:2)
The problem is that since this is accessible in javascript, you could, let say, paste that data in a hidden field, so that when a user post a form, it will post their clipboard. Or use Ajax to pu
Re: (Score:2)
The permission part is for the user experience. It annoyes the users sometimes fast. Imagine the following: I'm overriding the contextual menu to add functionality to my web app. Virtual ALL dumb corporate users go straight to the contextual menu when they want to do anything. Now, the COPY option is not there anymore, because I overrid it. So I need to put it back.
Staring at a monitor too long . . . (Score:2)
example (Score:2, Informative)
Re: (Score:3, Informative)
Oh Big Whoop (Score:4, Funny)
[SLASHDOT CLIPBOARD IE7 CONTENT DUMP for User eno2001]:
eno2001 14m431337h4ck3r (419)555-2727
Look at this later: http://www.iheartfurries.com/ [iheartfurries.com]
ub3rsm00vem4l3: So baby... my wife's out of town the whole weekend. Cum over and play?
SororityBabe6500000: Oh yeah! Let's party!
Books to read: How to Build a Nukyelar Bomb in Your Basement for Less than the cost of a Washing Machine, Trisexuals are People Too: A Study in Prejudice, How to Win an Election the Easy Way (Diebold Hacking)
Important investment info: Steve B said I should sell the Novell stock early next week. Remember to tell Feingold ASAP.
[END SLASHDOT IE7 CLIPBOARD CONTENT DUMP]
Only in Opera (Score:2, Interesting)
Workaround for IE6 (Score:2, Informative)
This has an interesting side effect on the "harmless" exploit page mentioned in the article, though. The script on t
Who would have thought (Score:2)
Re: (Score:2, Troll)
My IE7... (Score:2, Informative)
Google docs and spreadsheets (Score:2, Insightful)
Security settings (Score:2, Insightful)
Unless this is something completely different... (Oh, and please fill in my survey for my dissertation! http://www.survey.flere.co.uk/ [flere.co.uk]
Security settings-wonderful if you know about them (Score:4, Insightful)
Yes.
Do we even know about, let alone go through all 5,000 braindead security settings that Windows seems to have these days? Hell no. After a while, you have to assume a vendor would do SOMETHING right. This one floored me completely. I thought a dozen open network ports on a home desktop OS was stupid, but this is beyond belief.
Things like this are why I moved to Linux. It's simply impossible to keep up with every idiotic setting that needs to be changed after a default Windows install.
Ironic. (Score:2, Insightful)
Re: (Score:2)