UX on "ClickFix" feature is hostile, user unfriendly

[mcclure]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• using a new, unmodified browser profile.

Description

There is a "ClickFix" feature in uBlock Origin which attempts to prevent sites from covertly copying damaging shellscripts into the clipboard via JavaScript.

For about an hour there this week— see uBlockOrigin/uAssets#34321 — this was triggering for all attempts to copy via JavaScript on all sites. The bug was fixed, but even with the fix the bug reveals deeper, outstanding issues with the design of this feature.

When triggered, the feature looks like this:

As presentation to the user, this is unclear, inadequately helpful, and hostile in the case of a spurious trigger (which can still happen even in the "fixed" version).

A specific URL where the issue occurs.

https://imgbb.com/ (fixed) ( see https://github.com/uBlockOrigin/uAssets/discussions/27472#discussioncomment-18224466 )

(I continued seeing the problem sporadically on https://blacksky.community after the fix landed, but I haven't rebooted my browser.)

Steps to Reproduce

Checkout the version of UBO immediately before the fix for #34321 and follow the steps in #34321.

Observed behavior

The injected message, as shown above, is deficient in several ways:

1. It is entirely unclear. The word "Clickfix" has OK SEO, but it is jargon; I am relatively clued in on infosec and was aware of the ClickFix attack class, but had never heard the word "ClickFix" before. The word "ClickFix" does not appear in the uBO docs (linked on this bug submission page).
2. If the message triggers spuriously, the user is stuck. There is no "I trust it" button in the popup. There is no way to whitelist a site for copy/paste without disabling uBO completely for the site. There is not a ClickFix category in the "Filter Lists" settings in the uBO settings. There is no link to further information.

Expected behavior

I think any of the following changes would be good, from least to most disruptive:

• If you change nothing else, explain what a "ClickFix" is and how uBO protects against it in the documentation.
• Change the popup so instead of the confusing jargon "ClickFix" it explains what the site tried to do and why uBO blocked it ("This site tried to copy damaging computer code to your clipboard". Something like this)
• Explain ClickFix in the documentation and make "ClickFix" in the popup link to the explanation.
• Make it possible to disable the "ClickFix" protection, for example in the "Filter Lists" settings.
• Offer a button in the block popup to bring up a flow that personally whitelists the site for copying code uBO considers dubious but the user knows to be safe (my read of the code for this feature suggests when it is working correctly, it blocks copying any Powershell snippets that involve escalating privileges; this would be very awkward on, for example, a website containing a Powershell tutorial).

Configuration

Details

uBlock Origin: 1.73.0
Firefox: 140
filterset (summary):
 network: 182921
 cosmetic: 43691
 scriptlet: 34791
 html: 3780
listset (total-discarded, last-updated):
 default:
  user-filters: 8-0, never
  ublock-filters: 54104-72, 45m Δ
  ublock-badware: 10349-17, 45m Δ
  ublock-privacy: 4129-2, 45m Δ
  ublock-unbreak: 2866-1, 45m Δ
  ublock-quick-fixes: 516-13, 45m Δ
  easylist: 87190-142, 45m Δ
  easyprivacy: 56480-44, 45m Δ
  urlhaus-1: 47470-6, 45m
  plowe-0: 3539-1041, 1d.6h.45m
filterset (user): [array of 8 redacted]
trustedset:
 added: [array of 5 redacted]
userSettings: [none]
hiddenSettings: [none]
supportStats:
 allReadyAfter: 269 ms (selfie)
 maxAssetCacheWait: 92 ms
 cacheBackend: indexedDB

[stephenhawk8054]

Anyone is free to make PRs to the projects based on their ideas. This is community FOSS project. We are volunteers and we won't have time to adjust based on every single person's long essays of complaints.

[krystian3w]

In theory, it would help to switch the first string to ‘crowdin’ and use ${info}: ${text} in the scriptlet code.

[gorhill]

Can't trivially use localization for scriptlet injected in main world

[bingud]

Any update on this? the "protection" feature is disruptive and impossible to disable.

[gorhill]

Where are you getting false positives?

[bingud]

Its not a false positive, it is protecting me from copying a powershell script, but i dont have a way to turn this protection off

[stephenhawk8054]

If it's a public site, just tell us so we can exclude that domain in the filter lists for other users as well. If no one wants to report the public websites and just come here to complain without details, nothing can be done.

If it's a private site, just turn uBO off or add

yourprivate.domain#@#+js()

If you are using uBOL on that private site, set uBOL filtering mode in the popup slider to Basic.

But in general, you should not use uBO or any extensions in your private sites. uBO is not the suitable tool for that case.

---

Don't come here just to ask Any update on this? after we said that Anyone is free to make PRs to the projects based on their ideas.

[gorhill]

i dont have a way to turn this protection off

If you provide details about which website this happens, just say where this happens, then we can address it. If you do not want to provide details, then just disable uBO, that is the way to "turn this protection off".

[bingud]

Im a developer, i always copy random commands or scripts, i dont want to have to make a pull request just to be able to copy text on one specific domain.

There is a lot of customization in ublock, so i wouldve thought something that blocks your browser from copying text would be possible to disable, even if i had to use a custom filter rule or some other hack.

Yet it seems the only way to disable this rule is to disable the main filter list, which is called "Ads" in the UI.
I had to find this out by trial and error, because as a user, i have no clue what just blocked my browser from copying some text apart from it coming from ublock.

Having protection against ClickFix is great, but i think it shouldnt be in a list called "ads", non-togglable, without any option to "Copy anyway" or something.
I dont want to needlessly complain, but all i see is that the extension breaks copying and the official solution is "go complain about it in a PR"

[gorhill]

What's the point of all that text if you keep not providing details about which website this happens? If you keep not wanting to provide the steps to reproduce, there is nothing actionable on our side.

Closing the discussion with #4110 (reply in thread) as the answer.

[bingud]

It doesnt matter on which website it happens, copying this script snippet would be blocked on any non-whitelisted website.
My point is that i dont want to make a github issue or a new custom ublock filter every time it blocks me from copying.
The actionable thing would be to add a simple toggle to stop ublock from interfering with the clipboard, and optionally also documenting how the copy-blocking even works, because the current info banner that pops up when coping is blocked is cryptic and not actionable on the users side

[krystian3w]

There is no link to further information.

Theoretically, anyone with better English than mine can make a description on the draft Wiki:

https://github.com/uBlockOrigin/uBlock-issues/wiki/_history

I assume you could then do <a href=" " style="text-decoration: underline;"> in the scriptlet code.

EOT.