This is bugs.chromium.org/p/chromium/iss
This Tweet was deleted by the Tweet author. Learn more
Conversation
I was a bit wrong here. this was only for write-acces.
Quote Tweet
twitter.com/freddyb/status
A permission is still required to read the clipboard. There are multiple APIs for accessing the clipboard. One of those APIs required a user interaction with the page such as clicking on anything, scrolling, etc. for each read or write. The other did not.
Show this thread
1
5
Replying to
Nothing really changed because there's another API without the requirement of arbitrary user interaction with the page. The other API is forbidden by the standard from requiring user interaction since the intended privacy model is using permissions for API-based read and write.
1
Since they removed the user interaction requirement from one of the APIs, it can be used to read (with the permission granted) or write without the user clicking on something, scrolling, etc. The other API allowed it already. Not a real restriction without both APIs doing it.
I think part of what's needed is a one-time permission grant system, similar to what Android shipped in Android 11 and also displaying a notice when clipboard is read when the permission is granted, similar to iOS where that was introduced and also Android 12.
1
1
Should also be a default-enabled site setting for clipboard write access so it's possible to disable globally by default and enable it on a case-by-case basis for sites.
Requiring arbitrary page interaction would only help if they did both APIs, and current standard forbids it.
1
Show replies