Link hover security issue
Categories
(Core :: General, defect)
Tracking
()
People
(Reporter: firefox, Unassigned)
Details
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Steps to reproduce:
It is possible to create a link that, when hover over, appears different, than where it will actually take you, if you click on it. This is a serious security and privacy issue, as we are all taught to hover over a link to see when it will take you before clicking. The following show one way of doing so;
<a id="123-yt" href="http://thegoodsite.com" onmouseover="hoverfunction()" onclick="clickfunction()" oncontextmenu="clickfunction()">Link</a>
<script>
function hoverfunction() {
document.getElementById("123-yt").href="http://thegoodsite.com";
}
function clickfunction()
{
document.getElementById("123-yt").href="https://thebadsite.com/";
}
</script>
Facebook, gmail and other, use this or a similar technique to show an address of a link in the lower left corner, but when clicking on the link it takes you to a site that will redirect you to the final site. This is a privacy issue, and should not be possible.
Further it can be used to bring you to a completely different site for phishing or other malicious purposes.
Expected results:
It should bring you directly to the site that appear in the lower left corner.
|
||
Comment 1•6 years ago
|
||
(In reply to Torben from comment #0)
we are all taught to hover over a link to see when it will take you before clicking
We are? Taught by who? Tell them to stop doing that. It doesn't work. There's no way to fix this bug comprehensively short of disabling javascript on websites, which would break most of them.
It is not difficult to find cyber security companies and agencies that recommend you to do so, eg.
https://www.cyber.gov.au/advice/EasyStepsGuide
https://www.mcafee.com/blogs/consumer/consumer-threat-notices/holiday-scam-cybersecurity-survey
The issue that you say this is a duplicate of, has been fixed, and does not work any more, so it seems not to be completely impossible.
And, please stop writing as if everybody, but you, are stupid.
|
|
||
Comment 3•6 years ago
|
||
(In reply to Torben from comment #2)
It is not difficult to find cyber security companies and agencies that recommend you to do so, eg.
https://www.cyber.gov.au/advice/EasyStepsGuide
https://www.mcafee.com/blogs/consumer/consumer-threat-notices/holiday-scam-cybersecurity-survey
Both of these talk about links in scam messages/emails, which (normally) can't run JavaScript, so it makes some sense there - links can then not be manipulated, and the tooltip is correct. In your example, the author of the link does manipulate it with JS, and then the advice falls flat.
The advice to use bookmarks or otherwise access trusted sites directly via known web addresses, instead of via untrusted links, is better and more generally applicable. If your bank emails you, don't bother checking the links - access your bank's website directly and using a known address, instead of via links you got via email. More often than not, banks practice poor security and even the links in legitimate emails go to marketing domains that aren't the bank's primary domain anyway, so strictly speaking if you check them you would still find that you should not use them...
The issue that you say this is a duplicate of, has been fixed, and does not work any more, so it seems not to be completely impossible.
It's not clear to me what you mean; AFAICT the examples in the bug still work and are not meaningfully different from the one you have in comment #0.
And, please stop writing as if everybody, but you, are stupid.
My apologies, that was not my intent. It's just that there is no real way to protect against attacks like this, and so it is frustrating when people are given poor advice in this regard. There are ways where we can improve what we show for these events on legitimate websites (e.g. bug 1438660) but the tooltip cannot be made failsafe in the face of an active, malicious attacker who is allowed to run JS, so from a security perspective it is not generally useful as a means of protecting yourself.
Most people cannot understand the difference between a link in an e-mail and a link on a homepage, particularly with many people using webmail clients. Trying to distinguish between the different cases will only confuse people.
I see no other purpose of changing the href in mouseup, click or whetever events, then to conceal information from the user. Therefore I see no problem in breaking those sites, by preventing change of href by these events. Gmail and Facebook would work anyway, just they would not receive the click information. Many sites use "javascript:void(0)" as default href. In this case it should be obvious to the user that the information is concealed, thus an exception could be made for this case. I don't understand how .preventDefault could be used, so I may miss an important point here.
In my browser ( Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Linux x86_64 ), the following shows "....thegoodplace.html" when I hover over both links. If I click on Link1, I'll be taken to "...thebadplace.html", but if I click Link2, I'll be taken to "...thegoodplace.html" as the hover message says. So one case (bug:229050) has been fixed, while the other has not.
`<a id="123-yt" href="https://torhans.github.io/thegoodplace.html" onmouseover="hoverfunction()" onclick="clickfunction()" oncontextmenu="clickfunction()">Link1</a>
<script>
function hoverfunction() {
document.getElementById("123-yt").href="https://torhans.github.io/thebadplace.html";
}
function clickfunction()
{
document.getElementById("123-yt").href="https://torhans.github.io/thebadplace.html";
}
</script>
</br>
<a href="https://torhans.github.io/thegoodplace.html" onclick="javascript:location.href='https://torhans.github.io/thebadplace.html'">Link2</a>`
If you dare, you can test it at https://torhans.github.io/test_link.html
Apologies accepted!
|
|
||
Comment 5•6 years ago
|
||
(In reply to Torben from comment #4)
Most people cannot understand the difference between a link in an e-mail and a link on a homepage, particularly with many people using webmail clients. Trying to distinguish between the different cases will only confuse people.
Sure. But it seems you think that the advice should stay the same and browser should make the advice correct even in the homepage case, and I'm saying that browsers cannot do that so the advice is bad and should be changed. :-)
I see no other purpose of changing the href in mouseup, click or whetever events, then to conceal information from the user. Therefore I see no problem in breaking those sites, by preventing change of href by these events.
There are two problems with your claims here:
- Inferring malicious intent based on purely technical actions (like changing the .href in a click handler) is very often a losing game. For sure there are sites that change link targets based on actions taken by the user for "legitimate" reasons. They could even be complete changes from page A to page B on the same site.
- Preventing the change of href from events would not be sufficient. The website could intercept the click via a handler elsewhere and just send you somewhere else entirely based on that, completely ignoring the href.
As for your second example, the specifics of the example are broken. If I modify it from:
<a href="https://torhans.github.io/thegoodplace.html" onclick="javascript:location.href='https://torhans.github.io/thebadplace.html'">Link2</a>`
to
<a href="https://torhans.github.io/thegoodplace.html" onclick="location.href='https://torhans.github.io/thebadplace.html'; event.preventDefault()">Link2</a>`
it goes to the "wrong" place.
Really, it sounds like you want to change facebook and google's pages to not do this because you don't like what they do to the links you're clicking. In that case, an add-on that modifies those pages not to do this would be a good choice to fix the issue.
(In reply to :Gijs (he/him) from comment #5)
Sure. But it seems you think that the advice should stay the same and browser should make the advice correct even in the homepage case, and I'm saying that browsers cannot do that so the advice is bad and should be changed. :-)
Initially, yes, that's what I thought I wanted. I hindsight, I think, maybe the href should not be shown in the status area, as it misleads people to believe that this information is trustworthy.
<a href="https://torhans.github.io/thegoodplace.html" onclick="location.href='https://torhans.github.io/thebadplace.html'; event.preventDefault()">Link2</a>`it goes to the "wrong" place.
I accept you point.
Really, it sounds like you want to change facebook and google's pages to not do this because you don't like what they do to the links you're clicking. In that case, an add-on that modifies those pages not to do this would be a good choice to fix the issue.
In part, yes, but I would also like to educate people and make them aware how far Facebook goes to conceal the fact that everything is about harvesting information.
I'll look at the possibility to make an add-on for both purposes.
|
||
Updated•6 years ago
|
Description
•