Timeline for Why is "hovering over" a link in an email considered safe? Or is it harmful?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 9, 2017 at 19:58 | comment | added | unor | It might also be the case that what appears to be a single hyperlink consists of multiple hyperlinks with different targets. Example: Visit our site -- this can be detected if the UA uses suitable styling, and often by clicking-and-holding, after which you have to release the mouse button somewhere else (the clicked link will get an outline, unless the UA prevents this). | |
| Mar 4, 2017 at 18:42 | history | edited | Arminius | CC BY-SA 3.0 |
added 317 characters in body
|
| Mar 4, 2017 at 11:02 | comment | added | Gras Double | @JAB I have created a simple Greasemonkey script, see at superuser.com. | |
| Mar 4, 2017 at 4:44 | comment | added | user22260 | Unfortunately, the concerns raised here don't really apply to any real case -- most mail clients block JS in mails, and in case of mixed homographs, most mail clients display it in punycode instead of their original form. | |
| Mar 4, 2017 at 4:14 | comment | added | user21820 | @ShreevatsaR: There is; see above comment! | |
| Mar 4, 2017 at 4:09 | comment | added | user21820 | @JAB: If you're using Firefox or similar, there is Google search link fix. | |
| Mar 4, 2017 at 0:09 | comment | added | oldmud0 | Another homograph attack not listed is with i's. For example: the URL googIe.com ("googie") is not easily distinguishable from google.com with most sans-serif fonts. | |
| Mar 3, 2017 at 20:20 | comment | added | dandavis |
to be specific: the href cannot be forged since they removed window.status, rather google intercepts the click()s and does something else. In fact, if you just right-click (and cancel) a link you can see the href change from the clean actual url to the redirect URL, and the "tooltip" then shows the redirect url...
|
|
| Mar 3, 2017 at 20:06 | comment | added | ShreevatsaR |
@JAB Yeah. The workaround is to inspect the DOM before clicking on the link or clicking on "copy link address". (Right-click and "Inspect", or use something in the console like Array.from(document.getElementsByClassName('r')).forEach(x => console.log(x.firstChild.href)). There's probably an extension that already does this.)
|
|
| Mar 3, 2017 at 18:55 | comment | added | JAB | I hate that Google does that, because sometimes I just want to see the full link without actually going to the page. | |
| Mar 3, 2017 at 16:37 | vote | accept | JOW | ||
| Mar 3, 2017 at 15:21 | history | edited | Arminius | CC BY-SA 3.0 |
added 164 characters in body
|
| Mar 3, 2017 at 15:15 | history | answered | Arminius | CC BY-SA 3.0 |