logoalt Hacker News

afarah1today at 6:27 PM1 replyview on HN

You can disable it on Firefox by setting dom.event.clipboardevents.enabled to false. I haven't had any issues with it.

Someone shared the code in the comments, it uses 'copy' and 'cut' event listeners, so disabling this setting would have prevented the exploit regardless of an adblock.


Replies

edelbittertoday at 9:25 PM

dom.event.clipboardevents.enabled=false removes the non-consensual clipboard read access, which is an enhancement but not a strict requisite for attacks of this type. The utility of the other events boils down to mostly convenience: The website can still indirectly observe how you use the clipboard, even when not explicitly notified. The website also remains in control of the CSS properties that can be used to create a meaningful difference between user selection and resulting clipboard content after copying. And, crucially, (blindly) overwriting the clipboard is still permitted.