Why do we need to be careful when 'clicking' things? In other words, why do most security breaches involve clicking? Why doesn't simply loading something already constitute an issue? Why is the act of clicking the barrier between safety and risk?
In general, in order for there to be a problem on your computer,
- some piece of executable code (instructions) needs to get downloaded to your computer,
- and then it needs to get executed.
(Of course problems on other people's computers can hurt you in a great many ways, and a problem on your co-worker's computer can easily segue into a problem on your computer if, for example, that co-worker is in charge of pushing OS updates out to the whole team.)
Part #1 happens all the time.
Depending how your email is set up, I may be able to put arbitrary files on your machine just by sending you an email. This is less common these days, but it's still a valid example.
Every time you view a website, your browser downloads many files from that remote server so it can show them to you. That's what a website is.
Part #2 takes some work or luck.
So far in the two examples I've given (email and websites), your computer may not have executed any of the malicious instructions I'm sending you (but it probably has, I'll explain).
In the case of an email, the files (attachments) are completely inert until you tell your computer to do something with them. Typically, if you click on an attachment in an email, your computer will assume that you want to view that file, so it will ask your operating system for a program that can display files of that type (signified by the
.xyz extension), and then it will tell that program to open the file. At this point the only thing keeping me from executing code on your machine is the program that was chosen to open the file, and I have some control over what program that is.
- I can put links to my malicious website all over the internet, either by buying ad-space, or by having bots or sweatshop workers post links on various web-forums (including social media).
I may also be able to get someone else's website to run my code, either by hacking that website somehow, or by embedding my code in an advertisement. Both of these happen, they're just a step more difficult.
In short, "don't click stuff" is the stupidest accurate security advice possible.
If you never "click" anything (or equivalently activate it some way the doesn't use your mouse), then your computer won't do anything, which is safe. the threat-model that "don't click stuff" is supposed to protect against is people being tricked into executing code they didn't mean to on their computers.
Email attachments, links from emails, and online advertisements are the mainstream ways that such attacks occur. A lot of work has gone into making these types of attacks harder to pull off:
- Email servers will typically screen attachments or even links to try to detect if they're malicious.
- Both the programs on your computer that might be charged with opening an email attachment, and the OS that administrates them, have gotten better over the decades at sand-boxing processes and safely handing the files they read from.
- Ad networks are still a common malware vector, and you should use an ad-blocker for that reasons alone, but they have gotten better than they used to be. Most of the big networks now do some level of vetting of the ads themselves, so it's harder to push malware or malware-links over them.
- Our web-browsers have gotten better at limiting what code on websites is allowed to do. For example it used to normal to have your browser set up to run Flash programs or Java programs; these days it's basically unheard of because everyone knows it's dangerous.
TLDR: "Don't click stuff" is just shorthand for "People online will lie to you to get you to run their malware".
A gun is not dangerous until the trigger is pulled. That's the difference. Just having a gun lying around is not the problem. The problem is when it is triggered.
Yes, there are many cases where simply viewing something or even just receiving something can be enough, but that relies on specific vulnerabilities to exist. Those vulnerabilities tend to get patched quickly.
Clicking something is the computer's instruction that the user has approved something to happen. Something gets run. That does not depend on vulnerabilities; that depends on human action.