lukifer on Hacking the <a> tag in 100 characters

Comment on Hacking the <a> tag in 100 characters

While this should probably be fixed as prescribed by the author, it's relatively easy for a no-goodnik to accomplish the same goal without touch the href:

  $("a").click(function(e){
    e.preventDefault();
    document.location="http://evilsite.paypa1.com";
  });

In either case, a right-click to open or copy/paste sidesteps, though that's just a kludge.

devinblais 13y

I think this is an important point. The fact that you can change the href after the click is irrelevant because there are other (just as easy) ways to change where the link will be taking the user. If malicious javascript is being run on your page, THAT is your problem, not the href switch.

victorcsiky 13y

I've just came here to post this exact notice.

Thus You cannot just "warn users if the location of a link changes to a different domain after they click on it".

That said, this is probably a "wontfix".

Also, nowadays, the whole purpose of SSL certificates is actually doomed due to the "growth" - that is, rogue business people for profit without actual verification. In the beginning, one needed to fax in whole incorporation certificates and the like. Now, it is just like You pay for it, then maybe They phone You, maybe not.

Comments