Repa
Site Admin
User is Online
Joined: 26 Nov 2006
Posts: 1847
Location: North Carolina
Posted: Sat Sep 08, 2007 11:48 am Post subject: Stealing Clipboard Info · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Here's a post by aloverssunset(Sandra) that I saw in a thread in the Computer Help forum and decided to copy it here to preserve the information, as the topic is relevant to this category (thanks, Sandra):
------------------------------------------------------------
Want to find out if you have anything on your clip board and need to know how websites can stop reading your clipboard? Try this one...
Stealing Clipboard Info
Have you ever copied information to your clipboard, then later went online? If the info you copied was of a sensitive nature, then this is gonna scare ya like Bigfoot jumping out of your bathroom closet.
Did you know that a website can easily snatch the info on your clipboard with about one line of Javascript? Yup, it's true. Not all browsers are susceptible to this, but Internet Explorer is. Copy any line of this article and head to the page below:
http://www.worldstart.com/clipboardtest/clipboard-test Go on, I'll wait here. Take your time.
If it showed up on that page, then you're probably feeling a little anxious right about now. I mean, just imagine if that info had been a password, credit card number, or bank account info! I could have just as easily put the info on your clipboard into a database as shown it to you. Don't worry, I didn't - really, I didn't!
Want to know how to disable this "feature"? It's easy as fallin' off a digital log:
1. Open Internet Explorer and click the Tools menu, Internet Options.
2. Click the Security tab, then press the "Custom Level" button.
3. OK, grab your shovel, it's time to do some digging. Under the "Scripting" section, hunt for an entry called "Allow paste operations via script". Set to disable (or at least prompt).
4. Hit OK until you're back to Explorer.
5. That's it. Now try the page above and see what happens. With any luck, you should find that your clipboard is no longer accessible. Cool huh?
Special Note:
If you want to tell your friends about this little potential security problem, we've set up a special page at:
http://www.worldstart.com/clipboardtest The site even has screenshots to help you solve the problem
Sandra
_________________
Repa
Older than dirt!
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
Aloverssunset
Geekster Supreme
User is Offline
Joined: 16 Aug 2007
Posts: 468
Posted: Sat Sep 08, 2007 1:23 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
You are welcome, Repa
Sandra
_________________
Life is beautiful, live it wisely, fully, justly and with lots of love...S.M.
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
Rike
Site Admin
User is Offline
Joined: 23 Nov 2006
Posts: 864
Location: WA, AZ
Posted: Sat Sep 08, 2007 7:49 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Thank you both, Sandra and Repa. Very interesting information, and I never heard of it before! So I tried it with both, Firefox (which I use 99%) and IE7.
In Firefox, no info was passed on (I have NoScript) and in IE7, when I clicked on the worldstart.com site, I got a pop-up asking me if I wanted to allow this site to access my clipboard yes or no.
Very scary, though! IE6 probably does not have the pop-up, and many people are still using IE6!
Rike
_________________
Rike
"Time is what prevents everything from happening at once."
John Archibald Wheeler -
Back to top · Profile · PM · Email · WWW
--------------------------------------------------------------------------------
Aloverssunset
Geekster Supreme
User is Offline
Joined: 16 Aug 2007
Posts: 468
Posted: Sat Sep 08, 2007 8:02 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Yes when I first received the link and tried it, I had IE6 and no I didn't get the pop up that asked me first, it just showed what I had on my clip board. And yes it was scary. The thing about it is will the pop up appear in other websites or will they be able to steal the info without asking first? That is something to wonder and maybe worry about...
Sandra
_________________
Life is beautiful, live it wisely, fully, justly and with lots of love...S.M.
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
Repa
Site Admin
User is Online
Joined: 26 Nov 2006
Posts: 1847
Location: North Carolina
Posted: Sat Sep 08, 2007 10:17 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
If you have IE6, just make sure that "Allow paste operations via script" is set to "Prompt" in Internet Options under the Security Tab > Custom Level button and you will get the pop-up box. Both my computers are set to "Prompt" because I want the option, depending on what website I am on. I can't remember if that is the default or if I set them that way a long time ago.
_________________
Repa
Older than dirt!
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
Aloverssunset
Geekster Supreme
User is Offline
Joined: 16 Aug 2007
Posts: 468
Posted: Sat Sep 08, 2007 10:37 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Thanks Repa, I do have IE7 now and it does prompt me automatically. I had not set those settings, I believe it is a feature to IE7. I received the link to test world start about 4 years ago when I had IE6.
Your post should help the many who still deal with IE6.
Sandra
_________________
Life is beautiful, live it wisely, fully, justly and with lots of love...S.M.
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
Rike
Site Admin
User is Offline
Joined: 23 Nov 2006
Posts: 864
Location: WA, AZ
Posted: Sat Sep 08, 2007 11:46 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
It was set to "prompt" in my IE7 and I changed it to "disable". Now I'm reading your post, Repa, and you say
Quote:
Both my computers are set to "Prompt" because I want the option, depending on what website I am on.
so I need to ask you why or when would i like a web site to be able to read my Clipboard?
Rike
_________________
Rike
"Time is what prevents everything from happening at once."
John Archibald Wheeler -
Back to top · Profile · PM · Email · WWW
--------------------------------------------------------------------------------
fay47
Royal Geek
User is Offline
Joined: 23 Nov 2006
Posts: 590
Posted: Sun Sep 09, 2007 12:38 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Sandra
I have IE7 and also got the prompt. I don't remember setting it either so I do think it must be a default. But I went in and looked and it can be changed. I tried changing it just to see, but then I went and changed it back to prompt.
Fay
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
Repa
Site Admin
User is Online
Joined: 26 Nov 2006
Posts: 1847
Location: North Carolina
Posted: Sun Sep 09, 2007 12:50 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Rike, if I were on any unfamiliar website and I copied something to the clipboard and got that pop-up, I would reply no. But there are times when I am on a website like msn hotmail, composing an email and wanting to copy stuff to paste into the email when that pop-up appears. In this case, I certainly want the option to complete the copy and paste operation into the email I am composing.
I do have IE6, BTW, but cannot remember whether "Prompt" is the default or if I changed it to "Prompt" a long time ago. I do run with much tighter security settings than the defaults, so I could have set it - just can't remember.
_________________
Repa
Older than dirt!
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
fay47
Royal Geek
User is Offline
Joined: 23 Nov 2006
Posts: 590
Posted: Sun Sep 09, 2007 1:13 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Repa,
Can you explain you reply to RIke a little more.
To play around, I went in and chagned the option to deny. I copied soemthing to the clip board and could see it with the clipboard viewer. I wne to the link that was posted and it didn't how the contents of the clipboard.
I then clicked on rely to post in this board and it still let me copy in the contents, since I was doing the paste, the board was not accessing by code.
So, I don't quite understand the situaion you were explaing in your reply to Rike. Can you expalin why it is necessary to have it set to prompt or allow when you are actually doing the paste - It let me past with out it. Or more likely did I just misunderstand what you were saying?
Thanks,
Fay
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
Repa
Site Admin
User is Online
Joined: 26 Nov 2006
Posts: 1847
Location: North Carolina
Posted: Sun Sep 09, 2007 2:29 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Ok! If I am working on an email in hotmail and I have 2 emails open in edit mode, one I want to copy from, and another I want to paste into, here's what will happen when I select the 3 options for "Allow paste operations via script:"
Allow: allows the text in one email to be copied and pasted into the other email with no warning.
Prompt: on both the copy and paste operation, the pop-up message will say "Do you want to allow this page to paste information from your clipboard?" If I respond "Yes" when copying or pasting, it will allow the operation. If I respond "No" when doing either copy or paste, neither the copy or paste operation can be completed.
Disable: on both the copy and paste operation, there will be no warning, and when you try to copy or paste text, you cannot complete either operation.
Why is it this way on MSN Hotmail? Because they use scripts to complete these operations when you are working in edit mode (creating a new email, replying to an email). If you try to copy text from an email without putting it in edit mode (i.e., without selecting "Reply to"), then you can copy the text, as you are effectively highlighting and copying lines of a web page. But, if you have specified "prompt" or "disable" for the "Allow paste operations via script" setting, you cannot paste into an email that you are creating new or responding to unless the option "Prompt" has been selected and you reply "Yes." That's because you are working inside of the Hotmail editor at that point, which runs by scripts. When you are in the Hotmail editor, you are restricted by whatever option you have selected for "Allow paste operations via script."
Hope this makes things clearer.
_________________
Repa
Older than dirt!
Back to top · Profile · PM · Email
--------------------------------------------------------------------------------
fay47
Royal Geek
User is Offline
Joined: 23 Nov 2006
Posts: 590
Posted: Sun Sep 09, 2007 2:51 pm Post subject: · Quote · Edit · Delete · IP
--------------------------------------------------------------------------------
Repa,
Yes, that does clarify things. Hate to be a pest but I like to try to understand things as much as possible.
Thanks for the explanation.
Fay
Portal 
Subject: Stealing Clipboard Info 
