Pages

Wednesday, 28 December 2011

Word 2010, Word 2007 – how to paste plain text without formatting





This blog post shows how to change the default settings in Word 2010 or Word 2007 so that whenever you use Ctrl v to paste text into Word from a Webpage, PDF file or other source, it automatically pastes it without the original formatting as unformatted text, getting rid of all the font styles, bold etc formatting from the original source.

Paste Special is what I've always used when pasting text into a Word document. But in Word 2003, it took too many steps to go to menu, Edit, Paste Special, which has always been an annoyance for me.

In Word 2010 and Word 2007, there are two ways to paste text in unformatted form much more easily.

I'll cover both, but I'd recommend the quick way, which I cover first.

The quicker way

Here's how to get to the best way to paste unformatted text in Word 2010 and Word 2007. This way sets your defaults, so that whenever you use the Ctrl v keyboard shortcut to paste text into Word, it automatically pastes it as plain unformatted text.

Apart from the "Set Default Paste" button mentioned above, you can get to the correct settings window by going to the menu File, Options in Word 2010 (in Word 2010, it's the Word graphic at the top left, then Word Options button at the bottom). Now click "Advanced" in the list on the left.

image

Now go to the "Cut, copy and paste" section, and use the down arrows against the various itmes to set "Keep Text Only". I retain "Keep Source Formatting" when it's pasting within the same document (though I may change that to Keep Text Only as it can be a pain when moving text to footnotes from the main body).

Then OK, and that's it.

In future, Ctrl v will automatically paste without the original font style, size etc. You may still have to edit the spacing etc, but it's a lot less annoying, for me.

How to get rid of paste options popup too

While you're at the Advanced options, if like me you hate with a vengeance the "Paste Options" popup that appears as default in Word whenever you paste anything, and gets in the way by blocking what you're viewing.

image

You can also get rid of that and stop it popping up all the time.

The slower way

In Word, once you've copied text to clipboard, you can press Ctrl Alt V – then arrow up or down (or keep pressing u) to choose "Unformatted text" or "Unformatted unicode text".

image

Or in Word 2010, for mouse users, in the Home menu, click the down arrow under the Paste icon on the left of the ribbon.

image

This gets you to the same box as Ctrl Alt v above. However, there's a better solution here. Once you click the down arrow under Paste, you can click the "A" button show outlined in red below, to paste just the text.

image

Or, if you rightclick in the body of the document, you get the same Paste Options where you can click the A button.

But better still, click "Set Default Paste". This gets to a window that lets you set options permanently. I'll cover below another way to get to that window, and what to set in it.

For Word 2007, it's similar, but you only get a Paste Special option (which brings up the box where you choose Unformatted text), there's no A button.

image


How to do this - in the "Show Paste Options button when context is pasted" line also outlined in red above, just UNtick the box and OK.

The slower way

In Word, once you've copied text to clipboard, you can press Ctrl Alt V – then arrow up or down (or keep pressing u) to choose "Unformatted text" or "Unformatted unicode text".

image

Or in Word 2010, for mouse users, in the Home menu, click the down arrow under the Paste icon on the left of the ribbon.

image

This gets you to the same box as Ctrl Alt v above. However, there's a better solution here. Once you click the down arrow under Paste, you can click the "A" button show outlined in red below, to paste just the text.

image

Or, if you rightclick in the body of the document, you get the same Paste Options where you can click the A button.

But better still, click "Set Default Paste". This gets to a window that lets you set options permanently. I'll cover below another way to get to that window, and what to set in it.

For Word 2007, it's similar, but you only get a Paste Special option (which brings up the box where you choose Unformatted text), there's no A button.

image


Wednesday, 7 September 2011

Internet Explorer cookie contents - the new format analysed





Microsoft changed the way that Internet Explorer cookie files work and randomised cookie filenames, for security reasons; the cookie text files now have random names which don't indicate the name of the website that saved the cookie, and you have to open up each cookie file individually to check what that is.

However, you can still view the contents of all your IE cookies, unmangled, by exporting your cookies to a single cookies.txt file. Then if you open up that cookies.txt file, you can see the cookie info, in a much more comprehensible, intelligible user-friendly format, eg:

Webtrends seems to be used by Microsoft for recording web visitor analytics & statistics info.

I compared the contents of a couple of the new cookies against the cookies.txt versions to try to figure out how they work. I found that if you copy and paste the text from the cookie file into something else (eg a new text document), the info is broken up into separate lines (ie there's hidden new lines to separate the different components of the info).

For example, the contents of a Twitter cookie file named J0R4GWEF.txt, which like the other contents of cookies appeared to run continuously on in the txt file, was split up like this:

guest_id
v1%3A131542058071389408
twitter.com/
214748475215010693123032155316242192030174605*

The cookies.txt equivalent of that was:

twitter.com TRUE / FALSE 1378897943 guest_id v1%3A131542058071389408

So that helps to figure out the new format of the cookie file. The elements seem to be in this order:

  1. variable name (eg "guest_id")
  2. variable value (eg "v1%3A131542058071389408") - the equivalent of the old "guest_id=v1%3A131542058071389408"
  3. domain name (ie the website which set the cookie, eg "twitter.com/")
  4. something I haven't figured out yet (in the example above, it's "214748475215010693123032155316242192030174605") - but it must convert to the expiration date for the variable (ie 1378897943 in the example above), which traditionally is the number of seconds since 1 Jan 1970, and shows up as the "proper" figure in the cookies.txt version. Maybe this long figure also contains other info about the cookie file
  5. * symbol - which marks the end of this variable, and the start of the next variable set by the website, whose name etc follow in the same order.

I worked out the purpose of the * from looking at a single Google cookie file, for example these contents, of a single txt file:

PREF
ID=15025770280c4f56:U=8cbfd7d77ff8ecf4:FF=0:TM=1315398473:LM=1315408615:S=zAzaJeJ5lq1Y-EEk
google.com/
1536
521981312
30321428
744646208
30174577
*
NID
50=IVMzsW2RssDmmdt21XYqM-m6GMBe731GqCispetEG495dEdHdl_tlLqIv8h8tINpCg1kI2lgsAgLheW-TVQzbGoBoiHfBjSJuhOPJSEfWVNTw-H-_Nt16tyNCyIL2zCf
google.com/
9728
2103298560
30211390
722926208
30174577
*

- showed up in the cookies.txt file as this:

google.com TRUE / FALSE 1378844158 PREF ID=15025770280c4f56:U=8cbfd7d77ff8ecf4:FF=0:TM=1315398473:LM=1315408615:S=zAzaJeJ5lq1Y-EEk

google.com TRUE / FALSE 1331583355 NID 50=IVMzsW2RssDmmdt21XYqM-m6GMBe731GqCispetEG495dEdHdl_tlLqIv8h8tINpCg1kI2lgsAgLheW-TVQzbGoBoiHfBjSJuhOPJSEfWVNTw-H-_Nt16tyNCyIL2zCf

Final example, from a Facebook cookie:

eLlnTol8k9yayreWIGxF-h6m
facebook.com/
2147492864
3767864320
30321455
3978419216
30174604
*
translates to:

facebook.com TRUE / FALSE 1378856079 datr eLlnTol8k9yayreWIGxF-h6m
datr

I've not yet worked out how the name of the cookie text file relates to anything in its contents (which no doubt is part of the purpose of the security fix!), so you still can't tell which file was set by which site without opening up each file. The order of info in the cookies.txt document doesn't match the order of the dates that the cookies were created or modified, and they're not in alphabetical order of domain name either. But at least it's possible to check out all the contents of all cookie files at once.

Internet Explorer cookie names change





Worried that your cookie filenames have changed to incomprehensible random strings of letters and numbers? No need. Microsoft has, for security reasons, changed the way IE cookies are named. This is to improve security and reduce "cookiejacking", addressing one way in which attackers might be able to access your cookies (which could include your login information etc).

Side effects: some apps depending on the old cookies names system broke, eg CCleaner and WinPatrol. Also, it's now harder for users to figure out which cookies were set by which websites, as you can't tell the website name from the cookie name anymore. You have to open up the cookie file to check.

However, other browsers like Firefox aren't affected by the change - it's Internet Explorer only.

Old cookie names structure

Internet Explorer cookies used to have filenames with the structure: yourcomputerloginname@partialdomainname.txt eg johnsmith@microsoft.txt (or johnsmith@msdn.microsoft[2].txt etc).

IE cookies are typically located in your AppData\Roaming\Microsoft\Windows\Cookies folder (to find the AppData folder, click Start, in the search box type "appdata" without the quotes and hit Enter. If that doesn't work try "%AppData%" again without the quotes which may go straight to the "Roaming" subfolder).

The security hole, and update

However, in August Microsoft released a Cumulative Security Update for Internet Explorer (2559049) which (according to Microsoft Security Bulletin MS11-057) addresses a "Drag and Drop Information Disclosure Vulnerability CVE-2011-2383" which existed because IE (all versions) didn't properly restrict access to store cookie files.

In more detail for the techies, before the update Internet Explorer did not "properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue".

This vulnerability meant that "An attacker who exploited the vulnerability when a user views a Web page and performs a drag-and-drop operation could gain access to cookie files stored in the local machine."

What the security fix changes

To fix the vulnerability, this update modified how Internet Explorer accesses locally stored cookies, and how it manages cookie files. These changes included changing how Internet Explorer sets file names for cookies, to help make cookie file names less predictable.

Reportedly this change has been seen in several Windows operating systems, ie XP, Vista and Windows 7, and several versions of Internet Explorer including IE8 and IE9 (which would make sense as Microsoft's info says the vulnerability affects Internet Explorer 9 and previous versions).

A Microsoft blog explained the change - see the "Cookie Filenames are Randomized" heading. It's now harder for attackers to guess the location of a particular cookie as IE cookie files are now named "using a randomly-generated alphanumeric string. Cookies are not instantly renamed on [the security] upgrade, but are instead renamed as soon as any update to the cookie’s data occurs."

Consequences of the cookie name change

Now, cookie names look like this:

As mentioned earlier, certain software depending on the old system doesn't work anymore, and will have to be tweaked.

From the viewpoint of those protective of their privacy, while you can't see the website's name from looking at the cookie filename, you can still see it if you open up the cookie in Notepad or other text editor.

For example, here's the contents of cookies saved by Microsoft when I visited and then re-visited their webpage about the cookie change. You can see "microsoft" in there:

And here's the contents of a cookie saved by Google when I searched for info on the cookie change using the search box in Internet Explorer. Again, you can see "google.com" in there, although the filename is now "25Z1H29G.txt", and no longer mylogin@google.txt:

Link

For more details of how it seems to work behind the scenes, I've done a separate blog post on how to view the contents of your Internet Explorer cookies in a more user-friendly way.