Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

0. You visit a webpage with expectation to see a magic trick.

1. When you click on a card, there is no copying involved. But it knows on what card you clicked.

2. Pages asks you to paste the card you think you have in clipboard. You press Ctrl+V, page receives content of your clipboard and instantly replaces textarea content with card you clicked on. This makes you think that you have that card in your clipboard. Your real clipboard with your bank password you used 10 minutes ago is sent to the server.

3. Your clipboard is replaced with different card (adding text to clipboard is allowed and easy in javascript, it's reading clipboard what is forbidden).

4. Pages asks you to open some text editor (e.g. google doc) where you paste the card, seeing new card. This makes you thing that your card was replaced with joker card and it is some kind of lame magic trick.



You missed step 5 where it replaces it with the Twitter URL only when you paste it in the URL bar from Google Docs (but continues to be the card when you paste it in the doc). How does that work?


I didn't paste with a keyboard shortcut, so I had no idea what type of weird anti-performance art this was supposed to be. Thanks for explaining. Needless to say, this didn't work at all for me.


Kiss goodbye to that 20 bitcoin then




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: