Don't fuck with paste

[koenraad]

By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…

[jessriedel]

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read all the code to see how this extension works, and what it's [not] doing with your data.

The problem is that even if I read the code, or more likely chose to trust that someone has, it's not guaranteed to remain true for future updates. The author's scruples may weaken with time, or they might sell the extension, etc. (I think Chrome's extensions auto-update, but even if they didn't I'd still have to remember that this extension is one that I can't assume it's safe to update.)

[dkjaudyeqooe]

To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least.

Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere.

If only I could meet the people who make these decisions in person...

[2024throwaway]

I use Hammerspoon for Mac, have a shortcut set up for Cmd+Shift+V to actually type the letters rather than use the paste function. Works every time someone pulls this stunt.

> hs.hotkey.bind({"cmd", "shift"}, "V", function() hs.eventtap.keyStrokes(hs.pasteboard.getContents()) end)

[brushfoot]

I do the same with AutoHotkey for Windows. It's also come in handy in remote connection GUIs that default to the remote clipboard and legacy desktop applications with controls that don't support pasting.

[bobbylarrybobby]

Keyboard Maestro is also a fantastic app for this kind of stuff, and even adds a reasonable delay between keystrokes (something like 0.05 seconds) to prevent any weirdness.

[reaperman]

I also do this with AHK on Windows, even using the same keystroke. Though I add a small 10-50ms delay between each keystroke, otherwise the input can get mangled sometimes.

[rattray]

Thank you. I added this myself, but with option instead of shift (because cmd+shift+v already does "paste without formatting" iirc) like so:

    -- https://news.ycombinator.com/item?id=39640745
    hs.hotkey.bind({"cmd", "alt"}, "V", function()
      hs.eventtap.keyStrokes(hs.pasteboard.getContents())
    end)

[naltroc]

Yessss this also solves for Google Sheet's overkill hijack

[danlugo92]

> have a shortcut set up for Cmd+Shift+V to actually type the letters

Seems like this would be hard to "google"... can you provide a guide or a link to a guide on how to accomplish this?

[autoexec]

You shouldn't need to trust an addon for this, it's something you should be able to set in the browser.

In firefox you can toggle dom.event.clipboardevents.enabled

[oldandboring]

I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but.

But. I have implemented these exact security measures into web applications. I've been handed the requirements and I implemented them. I asked my client why we had to do this, when "everyone" knows that this stuff is terrible user-experience and can backfire spectacularly for security (the same people who would memorize a shitty password and use it everywhere, will now write their expiring, "strong", impossible-to-remember password on a sticky note or save it to a text file or spreadsheet called 'passwords.txt' on their Desktop). The answer is: we have to, for compliance. To pass a security audit. To prove to some major client or insurance company that we have a number of industry-standard measures in place to improve security. Unfortunately, your bank does not care about the 2% of us using password managers. Everyone else is still memorizing passwords, forgetting them, and making jokes about it like it's 2003.

[morder]

This[1] alternative bookmarklet was posted here a while back.

[1]: https://bookmarkl.ink/ashtonmeuser/6e3869d8e468e016f22a4b4de...

[dugite-code]

Bookmarklets are seriously undervalued. This is a simple and more importantly readable fix for the issue.

[nedt]

In case of not being able to past I normally right click -> inspect element and in the console write $0.value="value from clipboard". Works almost everywhere.

Tampering with paste is kinda is like turning of autofill and the HTML5 standard is pretty clear when it should only be turned of: ".. particularly sensitive (for example the activation code for a nuclear weapon); or that it is a value that will never be reused (for example a one-time-key for a bank login) ..."

[pupppet]

Right up there with hijacking Ctrl-F.

[dylan604]

There's a lot of keyboard shortcuts that mean one thing in the browser but something totally different in another application. Now that it is common for many of these other applications to now be a web app, these keyboard short cuts are possible to start colliding.

Take GoogDocs as an example. Do you want the browser's find or the app's find if you hit ctrl-f in a Doc/Sheet/etc? The vast majority of the users want the app's. Reading a news site, most people would probably expect ctrl-f for the browser's search.

Just pointing out that hard rules will always have exceptions. Except for the TFA's point of copy/paste. Stop manipulating my clipboard with bullshit marketing/tracking bullshit!!!!!!!

[makeitdouble]

There are semi-legitimate cases where this is warranted. For instance when looking at a Notion database, standard Ctrl-F is almost useless, and document search needs to go through the notion API to return results, sometimes even related to the entries that are displayed on screen.

I say "semi-legitimate" because I actually wish they'd map to a different shortcut, but can see the case for user wanted the remapping.

This of course stems from earlier decisions to have that document handling style in the first place. IMHO it becomes a complex debate when on line between an online application and a webpage.

[strbean]

Recently learned that if you Ctrl-F again after the highjacking, it brings up the browser search box.

Discovered this thanks to a site (don't remember which) that included a tooltip about this fact in their hijacked search box. I was curious if it would work on Redocly search, which has no such tooltip, and it did. I'm not positive if this works universally, or is just an undocumented feature of Redocly's interface and won't work in places the developers didn't make specific accommodations for it.

Env: Chrome + OSX or Windows.

[grishka]

I just don't get it why browsers allow websites to override their own hotkeys. I'm sure it even required extra code to be written to work correctly.

Linear hijacks Cmd+F for example, very helpfully providing some terrible thing instead of my browser's built-in search that works the same everywhere. (it's the same Linear that thinks you can't not want wysiwyg markdown editing)

[AA-BA-94-2A-56]

Stripe’s API documentation does this and it gives me the shits, because it seizes up my M2 MacBook Pro for several seconds.

I can’t believe that it’s 2024, and I can’t simply grep some documentation.

[tom_]

And overriding Ctrl+K without even being so good as to give way when you type it a second time. Assholes.

[dugite-code]

Hell just hijacking any standard browser controls is infuriating when it catches you out when you're just not paying complete attention.

Edit: Apparently Firefox has the `permissions.default.shortcuts` config option

UNKNOWN: Services.perms.UNKNOWN_ACTION [0]

ALLOW: Services.perms.ALLOW_ACTION [1]

BLOCK: Services.perms.DENY_ACTION [2]

PROMPT: Services.perms.PROMPT_ACTION [3]

And in the site information panel you can disable the Override keyboard shortcuts permission on a per-site basis. Neat, doesn't solve the paste override issue though. Source: https://support.mozilla.org/en-US/questions/1241294#answer-1...

[Lio]

My personal hate is when webpages rebind scrolling to zoom.

I haven't used a mouse in almost 15 years. It's a constant source of annoyance when I try to scroll something with a map with my trackpad and it goes crazy zooming in and out.

[int_19h]

This is the biggest reason why I hate Discourse.

[lukeholder]

Stripe docs do that and it annoys me to no end. They let you use the native search if you press ctrl+f a second time but since there is a delay it causes chaos.

[notamy]

Ctrl-G and F3 often work to bypass that ime

[LM358]

I don't think anyone here can imagine my bewilderment, confusion, and ultimately anger, the day I discovered that in the web interface for Outlook, Ctrl+V is the default shortcut for... send email.

I would very much like to know what went through their heads when they decided on that. On further thought, maybe I don't.

[gardnr]

Jeff Atwood has an opinion: https://meta.discourse.org/t/options-to-disable-hijack-of-cm...

[oneeyedpigeon]

'Find in page' is now so broken on modern websites that the keyboard shortcut is the last of our problems.

[stn_za]

So much this.

[vault]

Anyone one else noticed OP got 399 upvotes for sharing a fork with no significant upgrades compared to the original repo?

[freediver]

This was one of those things that frustrated me so much that we ended building this natively into Orion browser (Tools menu -> Allow Copy & Paste). [1]

One of the joys of building your own browser.

[1] https://kagi.com/orion

[idonotknowwhy]

Cheers for making Orion. I don't know how you guys managed to support Firefox and Chrome extensions (on iOS) but it's amazing and made moving from Android so much easier!

[igetspam]

Brave has a "force paste" that I use now instead of Chrome and the linked plugin. I assume the motivation was the same. (What a*hole thinks blocking paste is reasonable??)

Good on you for solving this too. It's a nonsense bit of functionality.

[cute_boi]

The problem with orion browser is it is not opensource.

[quadhome]

Why allow pages to disable copy & paste at all?

[panja]

Sadly, I am not in that ecosystem :(

[ghostpepper]

How would you rate the security posture of Orion compared to Chrome?

[lolinder]

For something simple like this that doesn't really need to be on all the time I've started leaning back towards bookmarklets over extensions. The code is usually simple enough to actually audit, it only runs when you click the bookmarklet, and it doesn't update underneath you without warning.

A few months back someone shared several bookmarklets that they use, one of which was a simple one that disables all clipboard events on the open tab:

https://news.ycombinator.com/item?id=38014653

[eviks]

But then you need to click

Also you can get the extension loaded locally, and it will never update

[js2]

For Safari you can get Don't Fuck with Paste (and lots of other Don't Fuck with X options) with the Stop The Madness extension.

https://underpassapp.com/StopTheMadness/

[tracker1]

This really irks me to no end with password managers in particular. I like to generate 30 character random passwords and sites that limit input or block paste in the verify field are particularly annoying.

Similar for login and 2FA entry fields. There's no good reason for it.

I've often gone an extra bit to ensure password managers work well. I wish more sites would do the same.

[SubiculumCode]

There is one thing I hate more. Its having my cursor moved to another application as I am typing out a password in a field. I've literally had to change a password after it suddenly got sent out in a google search when I wasn't paying attention.

[j1elo]

Merging the bookmarklet version of the upstream addon this one is forked from [1] and another bookmarklet that has been posted in comments here [2], I got to this:

    javascript:['copy','cut','paste','contextmenu','selectstart'].forEach(e=>document.addEventListener(e,e=>e.stopImmediatePropagation(),true));

Right now I cannot think of any page that inhibits pasting, what is a good candidate to test this out?

[1]: https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-fi...

[2]: https://bookmarkl.ink/ashtonmeuser/6e3869d8e468e016f22a4b4de...

[megous]

Used to be simple to workaround this with basic web APIs (el.value = 'whateverIwant'), until this newfangled web framework from Facebook broke the web.

[Solvency]

How about an extension that STOPS websites from NOT letting me right-click. When a site forceS me to go through the stupid Chrome menu to laboriously drill down and find Developer Tools manually I want to throw it out the window.

[iansinnott]

100% in agreement with regaining paste. Another workaround is to create a macro that will "type" the clipboard contents, simulating typing it out by hand.

On macOS you can do this via Keyboard Maestro [1]. Create a macro with the action "Insert text by typing" and for the text to insert use `%PastClipboard%0%`.

Yes, very niche, but I'm sure some HN users already use Keyboard Maestro.

[1]: https://www.keyboardmaestro.com/main/

[BeefWellington]

Firefox has some about:config settings for this:

* dom.event.clipboardevents.enabled

* dom.allow_cut_copy

And also, the ability to force a paste as plaintext or force right-clicks to behave properly by using shift.