Sometimes there are links on the email you have to click because they are agrements, but they are coming from a different URL. As of now what I'm doing is opening a private window and pasting the link there. Would this be an effective anti-phishing mechanism? Or can you still get hacked?

The reason behind my thinking of a new private window is that it doesn't expose cookies and passwords to that window. Besides that what are other dangers that could arise?

What is the best way to click on email links then?


  • beefproject.com Aug 26 at 16:07
  • @CaffeineAddiction that looks like a whole environment for penetration testing probably you even have to boot into a different OS?, isn't there a solution for day to day activities?
    – Arturo
    Aug 26 at 16:10
  • No, thats an example of what can be used against you by clicking on random links. Aug 26 at 16:54
  • @CaffeineAddiction oh I see, very nice. I checked it quick I was in a meeting. I’ll watch the video they have later, very interesting.
    – Arturo
    Aug 26 at 16:56

It may protect against certain session hijacking attacks, but if the link points to a browser exploit then it doesn't matter whether or not you're in a private window.

If you don't trust the links, you should be opening them in a sandbox/VM that's isolated from your real system, has no data on it, and gets restored to a clean state after you do. Or better yet, don't click them.

  • Well sometimes you have to click them, for job interviews agreements etc
    – Arturo
    Aug 26 at 16:12

Pasting the link into a new window is good in that it gives you an opportunity to examine the URL before actually going there. A link that claims to be your bank or whatever with a URL to another country is almost always a bad sign.

By far, most current hacks are not direct Browser exploits anymore. Browser security has tremendously improved. The most likely next step in a hack is a request/requirement to download or install a driver or plugin or otherwise allow an executable. Don't do that!

If it's a Logon link to an account you have, is it the same URL you normally use to logon? If in doubt use your normal URL and not the link.

Direct exploits still occur occasionally but by orders of magnitude your primary protection is between the screen and the keyboard/mouse.

  • What about a link to a website you are logged in? For example I’m logged in into Facebook and I get a message that X event happened that I need to accept. Is it possible to mask the url and once gets to the destination grab the login info and redirect to the original website? Something of that kind
    – Arturo
    Aug 26 at 18:22
  • 1
    @Arturo - My personal opinion of Facebook is Just say No. That said, again examine the URL, does it look reasonable? Yes it is possible to have a store and forward man-in-the-middle web page that looks like the real thing but grabs content and forwards it. Certified HTTPS certificates do a good job of preventing this scenario. Any kind of a link to a web site you are already logged into should never result in another request for your password. Aug 26 at 18:35

No, if you don't trust the sender, don't click the links.

At very least, this can be used to obtain information about your system. Sloppy CORS configurations could also be easy targets (probably not an issue for say Facebook but even some minor bank might feasibly be vulnerable).

With that said, in most cases, you can reasonably figure out who the sender is and are they legitimate. The question though is - how often do you actually have to?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.