Unsigned applet: some machines can copy to clipboard, others can't

Question

My understanding of Java applet security says that an unsigned applet cannot copy-to or paste-from the system clipboard. However, on at least two systems at my office (but not mine) the user can highlight text in one of our applets, hit Ctrl-C and copy the text to the clipboard. All machines are current vintage, running MS XP and Java 1.4.2. I've checked the java.policy files and they are identical--there are no non-standard permissions in them.
Now my boss is complaining that I told him this couldn't be done without going the signed applet route. Does anybody know what's going on?

Answer 1

First of all if you're developing applets for your company (or another one) make sure they
have the jre set up correctly.
Any respectfull IT person within a company has IE security set up so why not the jre as
wel?
Using the default jre installation in your company? Are you allso using the default IE
install or did you not agree with some settings there?
Anyway here is how I think you should set up the jre for your companys people:
I think a good configuration would be a keystore and policy on the company's
Intranet to be used by everyone and if so needed a keystore and policy in the user home
folder to be edited only by admins. Add the 2 keystores to the java.security and the
admins can configure any special privileges to special applets (like IE security zones
but more detailed).
Add the following line to all codebases: "grant { " section in the java.policy/
permission java.lang.RuntimePermission "usePolicy";
Now the user does not have the option of "do you trust" for signed applets. I think this
is a verry good idea because anyone with a jdk can sign their jar.     
About someone beeing able to copy and the other one not, I guess you've given the
user too much freedom in changing their settings (the msjvm settings in IE). The
applet is probably not even run with the SUN jre because you are using the Applet tag.
Now I am not even sure if hitting crl + c does anyting with an unsigned applet but I would guess that accessing the clipboard from code should not be possible.