Hacker News new | past | comments | ask | show | jobs | submit login

There are legitimate security reasons why various major sites want to do this, and the changes do appear to be in response to actual, self-XSS attacks that have been seen. While I am no fan of the NSA, I don't see how this has anything to do with them. I also think this is very distinct from the right-click-disabling that used to be so popular: that was not in response to actual attacks, and also, to my knowledge, never happened on reputable sites. Additionally, I don't recall it being justified as being for "security" reasons: websites were usually rather honest about having it to prevent saving or copying and pasting.

This is, in my view, a poor solution to the problem, but as a temporary measure, it makes some sense. A change to Chrome to make a warning message appear the first time the developer console is opened, or javascript is used in the location bar, could be a good idea. And, as the pastebin notes, there are likely better, if more complex, technical solutions from the website side. All of these, however, will take considerably more time and effort, and the attacks are already happening.




It doesn't have anything to do with the NSA. He was just saying that "for security reasons" is a stupid excuse that, he says, seems to be frequently used to excuse any nefarious behaviour.


If you expect me to run your code on my computer I expect to be able to see it first. The comparison to right-click jacking is quite apt.

Some people will keep on exploiting others no matter the format, nerfing things for everyone else is not a tenable solution.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: