Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a new tab is opened, or software is downloaded.

  • That being said, is it a risk to highlight text while reading a webpage?

  • What can be done to mitigate this risk?

share|improve this question
1  
Excellent question. As an inveterate highlighter, I'm often slammed when I hit a web site that pops up ads in response to OnClick() events. –  gowenfawr Aug 31 '12 at 17:05
add comment

5 Answers

It's hard to say just about anything isn't a risk if javascript is on. As far as I know, there is no good way to tell where an exploit might exist. That said, if you are really concerned about highlighting text on a page without risk, my recommendations would be to either a) turn off scripts such that onclick events don't occur, b) view source and copy the text directly out of the source or c) if the text is not available in the source, use a tool like firebug which can inspect the DOM and pull the text directly out of the DOM.

In general no-script on a site you don't trust is just good security to begin with though as there have been exploits that don't even require direct interaction with the page beyond simply loading it.

share|improve this answer
add comment

As far as I know the only risk could be your privacy since there are some widgets that sends back to the server what text you have selected. Browser add-ons such as Ghostery blocks these intrusive scripts.

share|improve this answer
add comment

That being said, is it a risk to highlight text while reading a webpage?

There isn't a risk unless the browser has an exploit dealing when text is highlighted.

What can be done to mitigate this risk?

Any browser worth using wouldn't have an exploit.

I won't even address the concerns raised by AJ dealing with JavaScript mainly because that risk is unique to a given browser's engine.

share|improve this answer
3  
"Any browser worth using wouldn't have an exploit." That's bold. They all seem to have various flaws at different times. –  Jeff Ferland Aug 31 '12 at 21:38
add comment

This sounds related to what NoScript's ClearClick is designed to prevent. (The protection applies even if you have NoScript set to "Allow Scripts Globally").

share|improve this answer
add comment

Wouldn't any user triggered event be a problem and not just OnClick?

But directly relevant to your question is clickjacking: http://security.stackexchange.com/search?q=clickjacking

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.