• 0 Posts
  • 42 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle
  • lando55@lemmy.worldtoTechnology@lemmy.worldBe careful.
    link
    fedilink
    English
    arrow-up
    3
    ·
    2 days ago

    Yeah that’s what I’m curious about; I’m used to copying code snippets or codes from websites by clicking a button (presumably through some browser API?), but am just now realizing that this in itself has security implications.

    Using noscript or some such JS blocker would prevent this but break a lot of other things in the process. That’s why I’m wondering why the API isn’t locked down via some user prompt.


  • lando55@lemmy.worldtoTechnology@lemmy.worldBe careful.
    link
    fedilink
    English
    arrow-up
    21
    ·
    edit-2
    2 days ago

    Why isn’t the default behavior for browsers to not allow access to the clipboard? Similar to how it prompts you for access to camera/microphone

    Edit: On a per-site basis, like if you use the Zoom website it asks you for access to the webcam, would something like this work for clipboard as well or would it break stuff?










  • What about this scenario:

    • you keep your main garage door, side doors, and windows locked
    • provide a key to anyone who wants to borrow your lawnmower or whatever
    • someone discovers a window you mistakenly left unlocked and starts using it to take stuff without using a key

    Would this be considered breaking in? Probably. Here is where the analogy breaks down; if I were to leave the front door of my house unlocked, even if there’s a welcome mat outside, anyone who enters without my knowledge or consent can be charged with breaking and entering (yes, even though no actual breaking is involved).

    The interesting thing with public APIs is that there are generally terms and conditions associated with creating an account and acquiring a key, though if you are hitting an unauthenticated endpoint you technically never agreed to them. In this particular case with Authy, it would probably be argued that the intent was to acquire data by exploiting a vulnerability in the custodian’s system and use it for nefarious purposes or profit. I’d call it a hack.