8

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a new tab is opened, or software is downloaded.

  • That being said, is it a risk to highlight text while reading a webpage?

  • What can be done to mitigate this risk?

Improve this question
1
  • 1
    Excellent question. As an inveterate highlighter, I'm often slammed when I hit a web site that pops up ads in response to OnClick() events.
    – gowenfawr
    Aug 31, 2012 at 17:05

5 Answers 5

Reset to default
2

This sounds related to what NoScript's ClearClick is designed to prevent. (The protection applies even if you have NoScript set to "Allow Scripts Globally").

Improve this answer
1

It's hard to say just about anything isn't a risk if javascript is on. As far as I know, there is no good way to tell where an exploit might exist. That said, if you are really concerned about highlighting text on a page without risk, my recommendations would be to either a) turn off scripts such that onclick events don't occur, b) view source and copy the text directly out of the source or c) if the text is not available in the source, use a tool like firebug which can inspect the DOM and pull the text directly out of the DOM.

In general no-script on a site you don't trust is just good security to begin with though as there have been exploits that don't even require direct interaction with the page beyond simply loading it.

Improve this answer
1

As far as I know the only risk could be your privacy since there are some widgets that sends back to the server what text you have selected. Browser add-ons such as Ghostery blocks these intrusive scripts.

Improve this answer
1
  • -1 Ghostery does its own nasty tracking and profiling. It is a cure worse than the disease.
    – forest
    Jan 18, 2018 at 20:57
1

Wouldn't any user triggered event be a problem and not just OnClick?

But directly relevant to your question is clickjacking: https://security.stackexchange.com/search?q=clickjacking

Improve this answer
0

That being said, is it a risk to highlight text while reading a webpage?

There isn't a risk unless the browser has an exploit dealing when text is highlighted.

What can be done to mitigate this risk?

Any browser worth using wouldn't have an exploit.

I won't even address the concerns raised by AJ dealing with JavaScript mainly because that risk is unique to a given browser's engine.

Improve this answer
1
  • 3
    "Any browser worth using wouldn't have an exploit." That's bold. They all seem to have various flaws at different times.
    – Jeff Ferland ♦
    Aug 31, 2012 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.