MSC4197: Copy Paste Hints #4197

anoadragon453 · 2024-09-22T08:39:24Z

Rendered

Implementations

Element Web (credit to @ara4n): copy hints draft implementation element-hq/matrix-react-sdk#83

This MSC was written live on-stage during the Matrix Conference 2024! (recording TBD)

proposals/4197-copy-hints.md

florianjacob

I have a security concern regarding copying something else to clipboard than the user expects.

florianjacob · 2024-09-22T08:57:05Z

proposals/4197-copy-hints.md

+
+### Security Considerations
+
+TODO.


Security concern: What if the text in content.body does not match the text in content.copy_hint, and the user then unknowingly has malicious content in their clipboard that does not match their expectation?

While alternative 5 adds more complexity to client developers, it reduces the attack surface to only be able to fill the clipboard with things that also are in the content.body text. However, the sender could still try to use rich text formatting to send invisible text that is then copied to the clipboard.

ara4n · 2024-09-22T09:08:29Z

proposals/4197-copy-hints.md

+
+### Security Considerations
+
+TODO.


There's a risk this could ease phishing attacks where people are encouraged to copy-paste official looking data into their javascript consoles...

To justify this concern, here's some well-known implementations of this attack:

This is already common on Discord: discord.com's safety docs

Certain types of scams already do this with Windows' Run box ("Press Win+R, press CTRL+V and enter to read this file")

ara4n · 2024-09-22T09:09:53Z

proposals/4197-copy-hints.md

+
+None considered!
+
+### Alternatives


might want to mention we're deliberately only letting you hint that a single thing is copyable, given you can only put one thing on a pasteboard.

ara4n · 2024-09-22T09:12:47Z

proposals/4197-copy-hints.md

+
+### Security Considerations
+
+TODO.


massive spam risk here; need to explicitly advise client implementors to not allow 2FA spam to create an explosion of dialogs or similar

ara4n · 2024-09-22T09:14:09Z

proposals/4197-copy-hints.md

+5. Use indexes in the message
+    * Harder to implement
+    * Use bandwidth
+6. If the event is encrypted, leave the 2FA code out of the encryption


A nice refinement could be delete-after copying semantics, but that should be an extra MSC - probably extending the existing MSC2228 self-destructing messages MSC

ara4n · 2024-09-22T09:14:44Z

proposals/4197-copy-hints.md

+    "body": "DO NOT SHARE THIS WITH ANYONE!!! Your 2FA code is: 100000",
+    "m.mentions": {},
+    "msgtype": "m.text",
+    "copy_hint": "100000"


please namespace the field, just as m.mentions is... - so m.copy_hint once merged

ara4n · 2024-09-22T09:14:56Z

proposals/4197-copy-hints.md

+
+### Unstable prefix
+
+While this MSC is unstable, all instances of the field name `copy_hint` must be replaced with `org.matrix.msc4197.copy_hint`.


Suggested change

While this MSC is unstable, all instances of the field name `copy_hint` must be replaced with `org.matrix.msc4197.copy_hint`.

While this MSC is unstable, all instances of the field name `m.copy_hint` must be replaced with `org.matrix.msc4197.copy_hint`.

ara4n · 2024-09-22T09:15:18Z

proposals/4197-copy-hints.md

+    "body": "DO NOT SHARE THIS WITH ANYONE!!! Your 2FA code is: 100000",
+    "m.mentions": {},
+    "msgtype": "m.text",
+    "copy_hint": "100000"


Suggested change

"copy_hint": "100000"

"m.copy_hint": "100000"

ara4n · 2024-09-22T09:15:30Z

proposals/4197-copy-hints.md

+* technical details
+* describe the solution (This is the solution. Be assertive.)
+
+`m.room.message` contains a new field, `copy_hint`, under the existing `content` dictionary. This new field will contain a string representing text that the client could present to the user to copy.


Suggested change

`m.room.message` contains a new field, `copy_hint`, under the existing `content` dictionary. This new field will contain a string representing text that the client could present to the user to copy.

`m.room.message` contains a new field, `m.copy_hint`, under the existing `content` dictionary. This new field will contain a string representing text that the client could present to the user to copy.

ara4n · 2024-09-22T09:16:09Z

proposals/4197-copy-hints.md

+* technical details
+* describe the solution (This is the solution. Be assertive.)
+
+`m.room.message` contains a new field, `copy_hint`, under the existing `content` dictionary. This new field will contain a string representing text that the client could present to the user to copy.


this should probably not be limited to m.room.message. it's effectively an extensible event mix-in to provide an alternative presentation of the message specifically for proposing copy-pasting.

ara4n · 2024-09-22T09:18:36Z

proposals/4197-copy-hints.md

+}
+```
+
+Clients MAY automatically copy the contents of `copy_hint` to the clipboard without asking the user. This is an implementation detail.


Suggested change

Clients MAY automatically copy the contents of `copy_hint` to the clipboard without asking the user. This is an implementation detail.

Clients MAY automatically copy the contents of `m.copy_hint` to the clipboard without asking the user. This is an implementation detail.

ara4n · 2024-09-22T09:23:28Z

proposals/4197-copy-hints.md

+
+### Alternatives
+
+1. `hints` dictionary.


Rather than coming up with a new taxonomy for hints, it's better to use extensible events... i.e. you'd do an m.other_hint_type if you don't want an m.copy_hint. Although it might be nice for them to have the same shape?

realtyem · 2024-09-22T12:12:40Z

proposals/4197-copy-hints.md

+}
+```
+
+Clients MAY automatically copy the contents of `copy_hint` to the clipboard without asking the user. This is an implementation detail.


Please don't do this. Beyond the security ramifications of a client copying what it wants to my clipboard, is the fact it means a program can overwrite whatever is in there and I may not notice that it happened. I might have been copying a huge chunk of something important and irreplaceable and now it's gone because someone else triggered a 2FA that is registered to my account

I agree. I don't want my client putting stuff in the clipboard without me telling it to.

uhoreg · 2024-09-23T01:27:03Z

proposals/4197-copy-hints.md

@@ -0,0 +1,65 @@
+# MSC4197: Copy-Paste Hints
+
+In Matrix today, it can be used for communication. One thing that is communicated is two-factor auth codes. In other platforms, one convenience is being able to quickly copy-paste two factor auth codes. This is not possible in Matrix today.


Please wrap your lines to about 80-120 characters

uhoreg · 2024-09-23T01:28:49Z

proposals/4197-copy-hints.md

+### Proposal
+
+* technical details
+* describe the solution (This is the solution. Be assertive.)


I think these two lines need to be dropped?

uhoreg · 2024-09-23T01:30:22Z

proposals/4197-copy-hints.md

+
+### Alternatives
+
+1. `hints` dictionary.


Can you explain what "hints dictionary" is?

uhoreg · 2024-09-23T01:32:17Z

proposals/4197-copy-hints.md

+}
+```
+
+Clients MAY automatically copy the contents of `copy_hint` to the clipboard without asking the user. This is an implementation detail.


I agree. I don't want my client putting stuff in the clipboard without me telling it to.

uhoreg · 2024-09-23T01:34:55Z

proposals/4197-copy-hints.md

+    * Harder to implement
+    * Use bandwidth
+6. If the event is encrypted, leave the 2FA code out of the encryption
+


Another possibility would be to add a tag to a  element, say something like `Your 2FA code is 123456" which would allow the client to place a "Copy" button next to the text that is to be copied.

uhoreg · 2024-09-23T01:35:15Z

proposals/4197-copy-hints.md

+2. Leave things as is (please don't!)
+3. boolean `copy_hint` field (hint to client to copy the whole message)
+4. give up (similar to 2.)
+5. Use indexes in the message


What do you mean by "indexes"?

dbkr · 2024-09-23T08:25:03Z

proposals/4197-copy-hints.md

+}
+```
+
+Clients MAY automatically copy the contents of `copy_hint` to the clipboard without asking the user. This is an implementation detail.


Looks like there are plenty of problems pointed out with this but nobody suggesting solutions, but it feels like all the issues are readily solvable by just changing this to suggest something like searching for that text in the message and decorating it with a little copy button.

dbkr · 2024-09-23T08:27:57Z

proposals/4197-copy-hints.md

@@ -0,0 +1,65 @@
+# MSC4197: Copy-Paste Hints


Could possibly be more general, ie. it's just picking out the pertinent information from a message rather than necessarily anything to do with copy/paste.

TheArcaneBrony · 2024-09-25T10:57:21Z

proposals/4197-copy-hints.md

+    "body": "DO NOT SHARE THIS WITH ANYONE!!! Your 2FA code is: 100000",
+    "m.mentions": {},
+    "msgtype": "m.text",
+    "copy_hint": "100000"


How would I be able to add multiple copy hints? Do I post extra empty messages per hint? Can I set the text to display on the copy button? Thinking for example, a moderation bot might want to provide a way to copy a list of MXIDs, it would be nice to able to say "Copy table", "Copy User IDs", ...

Additionally, i wonder if this might be better implemented using a custom HTML tag/property, eg. Your 2FA code is 100000, with ommission of a value copying the innerText.

I agree HTML would be a more elegant solution. Additionally it would make it much easier for humans to send messages with copyable parts.

anoadragon453 force-pushed the anoa/copy_hints branch from 8eb37d8 to cd98dff Compare September 22, 2024 08:40

MSC4197: Copy Paste Hints!!!

bb7a8d5

anoadragon453 force-pushed the anoa/copy_hints branch from cd98dff to bb7a8d5 Compare September 22, 2024 08:40

anoadragon453 changed the title ~~MSC0000: Copy Paste Hints~~ MSC4197: Copy Paste Hints Sep 22, 2024

turt2live added proposal A matrix spec change proposal needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. labels Sep 22, 2024

KitsuneRal requested changes Sep 22, 2024

View reviewed changes

proposals/4197-copy-hints.md Outdated Show resolved Hide resolved

KitsuneRal reviewed Sep 22, 2024

View reviewed changes

proposals/4197-copy-hints.md Show resolved Hide resolved

anoadragon453 added 2 commits September 22, 2024 10:45

Fix the example

e2f6046

Add an unstable prefix

303b7d7

turt2live removed the needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. label Sep 22, 2024

florianjacob suggested changes Sep 22, 2024

View reviewed changes

anoadragon453 marked this pull request as ready for review September 22, 2024 09:01

ara4n mentioned this pull request Sep 22, 2024

copy hints draft implementation element-hq/matrix-react-sdk#83

Closed

3 tasks

ara4n reviewed Sep 22, 2024

View reviewed changes

realtyem reviewed Sep 22, 2024

View reviewed changes

uhoreg reviewed Sep 23, 2024

View reviewed changes

dbkr reviewed Sep 23, 2024

View reviewed changes

TheArcaneBrony reviewed Sep 25, 2024

View reviewed changes

turt2live added client-server Client-Server API kind:feature MSC for not-core and not-maintenance stuff labels Sep 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MSC4197: Copy Paste Hints #4197

MSC4197: Copy Paste Hints #4197

anoadragon453 commented Sep 22, 2024 •

edited

Loading

florianjacob left a comment

florianjacob Sep 22, 2024

ara4n Sep 22, 2024

TheArcaneBrony Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

ara4n Sep 22, 2024

realtyem Sep 22, 2024

uhoreg Sep 23, 2024

uhoreg Sep 23, 2024

uhoreg Sep 23, 2024

uhoreg Sep 23, 2024

uhoreg Sep 23, 2024

uhoreg Sep 23, 2024

uhoreg Sep 23, 2024

dbkr Sep 23, 2024

dbkr Sep 23, 2024

TheArcaneBrony Sep 25, 2024

greentore Sep 26, 2024


		### Unstable prefix

		While this MSC is unstable, all instances of the field name `copy_hint` must be replaced with `org.matrix.msc4197.copy_hint`.

	`m.room.message` contains a new field, `copy_hint`, under the existing `content` dictionary. This new field will contain a string representing text that the client could present to the user to copy.
	`m.room.message` contains a new field, `m.copy_hint`, under the existing `content` dictionary. This new field will contain a string representing text that the client could present to the user to copy.

	Clients MAY automatically copy the contents of `copy_hint` to the clipboard without asking the user. This is an implementation detail.
	Clients MAY automatically copy the contents of `m.copy_hint` to the clipboard without asking the user. This is an implementation detail.

		@@ -0,0 +1,65 @@
		# MSC4197: Copy-Paste Hints

		In Matrix today, it can be used for communication. One thing that is communicated is two-factor auth codes. In other platforms, one convenience is being able to quickly copy-paste two factor auth codes. This is not possible in Matrix today.

MSC4197: Copy Paste Hints #4197

Are you sure you want to change the base?

MSC4197: Copy Paste Hints #4197

Conversation

anoadragon453 commented Sep 22, 2024 • edited Loading

Implementations

florianjacob left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

anoadragon453 commented Sep 22, 2024 •

edited

Loading