0

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen.

Can I trust this? Can this display be spoofed? For instance, can Javascript display something to make it look like the link is to URL A when clicking on the link will actually take me to URL B?

I recently received some advice that, before clicking on a suspicious link, I should hover over the link to see where it will go. I personally find this extremely dubious and I suspect there are multiple ways that this can be fooled, but I wanted to ask here among folks who may have thought about this more deeply than I.

Improve this question
0

2 Answers 2

Reset to default
3

the onclick javascript action is performed first (did this once to hash a password in browser in a form) and afaik that would enable the site to direct you somewhere else. So no, the destination can be changed between clicking and following the link.

Improve this answer
2

Sebastian is absolutely correct here. I just wanted to add some code to give you a real example of how easy this would be.

<!doctype html>
<html>
<head>
  <title></title>
  <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>
</head>
<body>

<a href="http://security.stackexchange.com/questions/44122/can-you-trust-the-url-shown-when-hovering-on-a-link">Can you trust the URL shown when hovering on a link - Security.SE</a>

<script>
$("a").click(function( e ) {
  e.preventDefault();
  window.location = "http://www.google.com";
});
</script>

</body>
</html>
Improve this answer

Not the answer you're looking for? Browse other questions tagged .