Ask HN: How to disable right-click blocking in the browser

https://news.ycombinator.com/item?id=32285459

by saimiam • 4 years ago

58 64 4 years ago

news.ycombinator.com

My bank’s website has this maddening “security” feature which prevents me from copy/pasting things like account numbers and avoid fat finger errors.

I would love this block to go die in a server fire.

gwnywg• 4 years ago

Add 'tamper monkey' extension to your browser and look through the source what class to remove from elements you are interested about.

Above comes with disclaimer, I personally don't allow any extensions in browser I use for banking. A little bit paranoid but I prefer to reduce plain of attack when accessing my bank (of course there are other threats that may bring more severe risk, remove them one at a time :) ).

susam• 4 years ago

I use Firefox and on Firefox this can be done by typing "about:config" (without the quotes) in the address bar, then searching for "dom.event.contextmenu.enabled" (without the quotes) and then double-clicking on the result to toggle its value from "true" to "false".

gazby• 4 years ago

The downside here is that there are still plenty of legitimate uses for capturing right-click, and this fix will impede operation of those.

I'd go with a bookmarklet style approach suggested by other top-level comments.

joshka• 4 years ago

What are these valid use cases?

lapcat12• 4 years ago

[self-promotion] My extension StopTheMadness stops this (supports all web browsers on macOS): https://underpassapp.com/StopTheMadness/

sogen• 4 years ago

Was just going to recommend Stop the Madness!

asvitkine2• 4 years ago

So the solution is to give the extension access to your banking site? Doesn't seem ideal.

Extension permissions still can't block an extension from making network requests if they have access to a site, right?

(Not implying this extension does something nefarious, but more the general risk of such extensions especially when we hear that sometimes extensions get sold or their authors accounts get compromised...)

alexvoda• 4 years ago

I completely agree. At least on Firefox there is an extension that restores right click and it is open source. If you want to be extra sure you can audit the code and package it yourself. This on the other hand appears to be closed source.

Even if it is benign now, there is no telling when it might be sold and new owners may have more nefarious intentions.

lapcat12• 4 years ago

You should definitely vet the developer before you install any software. I stake my reputation on my software, as a professional Mac developer for over 15 years. I'm pretty well known in that community, and my extension has also been well reviewed by the press.

sys_64738• 4 years ago

So the solution is to give the extension access to your banking site? Doesn't seem ideal.

I use a dedicated browser for all types of banking as you can't be too careful. Also, I don't run any extension on it for this same reason of being careful.

genezeta2• 4 years ago

I use a bookmarklet. It can be something basic, such as:

    javascript:void(document.oncontextmenu=document.onMouseDown=()=>true)

...which works for, maybe, 60% of cases. Or you can try a more sophisticated one for greater success. e.g.:

    javascript:(function(w){
        var arr = ['contextmenu','copy','cut','paste'];
        for(var i = 0, x; x = arr[i]; i++){
            if(w['on' + x])w['on' + x] = null;
            w.addEventListener(x, function(e){e.stopPropagation()}, true);
        };
        for(var j = 0, f; f = w.frames[j]; j++){try{arguments.callee(f)}catch(e){}}})(window);

Unfortunately, these don't work on 100% of the pages. Otherwise, as someone else has suggested, Firefox allows you to disable context menu hijacking for every site.

lifeplusplus• 4 years ago

Try making it immutable object

genezeta2• 4 years ago

abrioy• 4 years ago

In Firefox, holding shift while right clicking works most of the time. It display the default context menu regardless of the website.

For ins.tance you can shift right click a video to use picture in picture on Youtube

nomilk• 4 years ago

Related: I'd LOVE to know how to force standard ctrl + f behaviour on sites that override it.

Same for sites that override ctrl + left click (to open link in new tab - some sites will treat it like you simply clicked the link and open it in the same tab - super annoying).

breunigs• 4 years ago

As a workaround CTRL+L CTRL+F usually opens the regular find bar.

artemisart• 4 years ago

I use F3 for this, I don't know if it's possible but I've never seen a website hijack F3.

woqe• 4 years ago

Many browsers support ctrl + g to open the "find" input.

jeroenhd3• 4 years ago

In Firefox there is a permission for "keyboard shortcuts" or something similar. I've set the default value to disabled.

To do so:

- Open about:config

- Find or create permissions.default.shortcuts

- Set the value to 2 (BLOCKED) or 3 (PROMPT, not sure if that even works)

The changes should take effect immediately. If they don't, try restarting your browser.

You can then go into the page information dialogue (ctrl+I) and turn it back on for individual sites that need shortcuts to work well (like Google docs, maybe Discord).

Note that this might also affect shortcuts that do not conflict with your browser's shortcuts.

9woc• 4 years ago

Using Firefox, Shift-Right click shows the context menu. After that you can do your usual inspect etc.

simion314• 4 years ago

I use it all the time, is there a built in way(no extensions) to also force text to be selectable? ATM I need to find the css rule that disables select and siable it from dev tools

swores• 4 years ago

Reader view (F9 in Firefox) might solve the problem, though not as seamlessly as would be ideal.

vinni2• 4 years ago

Is there even proven benefits of blocking right click security wise? I wonder what is the rationale behind these decisions?

DecoPerson• 4 years ago

My wildly-speculative guess: some executive saw someone use “Inspect Element” and hosted an urgent meeting about how to solve this security risk. Rather than try to explain why it’s not a security risk, the dev team just placated the exec by saying “we could just disable right-click.”

ralmeida• 4 years ago

Probably some combination of security theater and well-intentioned but shallow, nearsighted and misguided attempt to increase security by reducing a perceived attackable surface area (i.e. likely somebody got scared with "View source" or something like that).

NickRandom• 4 years ago

In the old days (CompuServ and AOL era of the internet) a lot of sites used it as an easy way of reducing the number of 'right click, save picture' type visitors. It never stopped the determined but reduced it by at least 90%. I have no idea why it is used today though.

Zak• 4 years ago

I just saw someone request that the creator of a photo sharing site disable right-clicks for the same reason last month on reddit. I think I talked them out of it.

https://www.reddit.com/r/AnalogCommunity/comments/uw9fne/spe...

phantomathkg• 4 years ago

A lot of Japanese lyric websites disable right click. My hypothesis is because the Japanese Collection Society have very backward thinking about sharing lyric.

https://www.techdirt.com/2010/03/03/japanese-collection-soci...

jeroenhd3• 4 years ago

Actually, I've seen many videos of Indian scammers using "inspect element" to generate some fake "accidental money transfers" on their victim's bank account. They'll invent some way to make their victims believe that they've done something wrong and that they've received too much of a "refund" and then they'll either go the "I'm going to lose my job please send back the 30,000" card or the "this is a crime, the fbi will call you if you don't cooperate" card.

Making it difficult to inspect element+replace value might actually be worth the effort. I've seen a Kitboga video where a simple transparent div covering the entire page had the scammed stumped for minutes because they didn't actually understand HTML.

It certainly doesn't prevent viruses, but for scams it may just be enough to save some people.

netsharc• 4 years ago

To inspect element one can just open the developer tools from the menu or the shortcut key, and then use the "inspect" tool from there, this bypasses the context menu block.

I suppose low level hindrances are sufficient to block low-level intruders...

Overtonwindow• 4 years ago

I use a great Google Chrome extension called Allow Right Click that defeats that. Preventing right click is almost as asinine as preventing copying.

time_is_scary• 4 years ago

I also use this extension. It works on firefox as well.

Code is also on github if you want to learn from it: https://github.com/lunu-bounir/allow-right-click

if you go back to the first few commits you see it started similar to some of the small JS snippets people have suggested here. It is interesting to see how it has evolved

jrockway• 4 years ago

I always used xdotool to get around "you can't paste here". I may not be able to paste, but you didn't check the attestation signature on my keyboard!!!

stavros• 4 years ago

Ahh, I knew it was one of the x-tools that did this, but I didn't know the exact one, thanks! Might as well map ctrl+b to `xdotool type (xsel -b)`.

Jemm• 4 years ago

uBlock Origin adds a Block Element menu to the context menu.

zaza5761• 4 years ago

Ctrl + Shift + Right click force it to work in almost 99% of the time against right-click blockers in Firefox.

Don't have an exemple of when it would have failed :-)

throwway1• 4 years ago

window.addEventListener("contextmenu",function(e) { e.preventDefault(); //e.stopPropagation(); },false);

nextstepguy• 4 years ago

Absolute Enable Right Click & Copy Chrome extension.

sawmurai• 4 years ago

I remember when you could right click and hit enter at the same Time to still get a context menu

nokya• 4 years ago

You can't.

You can try, but you can't. The only people you'll stop are non-tech users, and the others will shame your business for playing this game.

If you need an analogy, think of it as trying to disable screenshots in an environment where users carry a camera in the other hand...

Ask HN: How to disable right-click blocking in the browser

Related Stories