Re: Copy to Clipboard - ambush and abuse by javascript

On Jun 2, 2010, at 17:14 , Tim Berners-Lee wrote:
> Example on MSNBC:
> http://today.msnbc.msn.com/id/29875493/ns/today-green/
> Very frustrating -- but a violation of the user interface.
> 
> It is discussed by John Gruber on:
> http://daringfireball.net/2010/05/tynt_copy_paste_jerks
> 
> "the site uses JavaScript to report what you’ve copied to an analytics server" when you perform a copy.
> This I think seriously violates the function of Copy, and the user's rights.
> 
> Should browsers ensure that Copy is always a read-only operation, unless they have INSTALLED code to do something different?

That likely wouldn't get you very far. The problem is essentially that you have the same runtime that can at the same time 1) see and react to what the user is doing and 2) communicate to the Web at large.

If we were to specify some form of "private copy" operation (as Jonas, relayed by Paul, describes here) it would block highjacking the copy operation, but it wouldn't block detecting text selection. Analytics information could then be deduced from that (which is likely close enough for decent statistics), and a hidden but selected attribution could also be injected.

The fact of the matter is that operation that you perform on an arbitrary page are not private. Every movement of your mouse cursor, the speed at which you scroll, whether you've actually finished reading the page, in some cases whether you've bookmarked or printed it, and yes, if you select some of its content — all of that can be tracked. I'm not saying that's a good thing, but we shouldn't delude ourselves as to the scope of the issue.

This is further compounded by the fact that if you add cute little buttons to a web page that offer "Share on Twitter|Facebook|Whatever" as well as "Bookmark", "Print", "Copy", or "Send to a friend", the vast majority of lay users will actually use these functions rather the ones from the browser or OS. And these are very reliably trackable (and, make no mistake, tracked). I'm guessing that that's how a service like http://www.addthis.com/ is able to be 100% free to millions of users despite what are probably rather steep bandwidth costs.

We can enter the arms race one small patch at a time, or we can try to come up with a global privacy strategy to end it. I think we'll go farther with the latter. In a helpful coincidence, the W3C is hosting a workshop precisely on this issue: http://www.w3.org/2010/api-privacy-ws/. All those in this thread who are interested should come. You have four days left to write up a position paper though, so get writing!

-- 
Robin Berjon - http://berjon.com/

Received on Thursday, 3 June 2010 13:04:25 UTC