The indirect security risk in links.

[kgun]

1. Once you activate a link, there are inherent security risks.

If you know JavaScript (JS) and event handlers written in JS, moving your cursor over a link on a page can be a security risk.

2. Invisible links and security risk.

That link may even be invisible (eg. same colour as the background).

3. Why is it a security risk?

Because moving your cursor over the link may trigger an event(handler). It is up to your fantasy to imagine what that eventhandler can activate.

4. The risk in getting IBL's (and code)

The code that you get e.g. in a request for reciprocal linking may be plain HTML, but it can also be JS. Then, if you do not have an overview of what that code does, there is an inherint security risk in pasting that code into your site.

5. Related WPW posts.

URL redirection, URL and browser hijacking.

Affiliate link hijacking.

[Lerza]

I understand your logic and agree that this is a feasible situation, however, it needs to be pointed out that JS events can be triggered by passive action as well.

It is much more likely that an unsafe event would be triggered with the loading of a page than with a rollover, because this would execute itself immediately and effect everyone who visits the page, whereas an event tied to a rollover would only effect those who initiated the action.

[kgun]

Excellent post as usual. It is implicit in point 4. above. You made it explicit.

[meddlingwithfire]

I agree that you shouldn't be haphazardly pasting other people's Javascript code into your site -- but it sounds to me (and pardon me here, I'm pretty new to these forums) like you're making an argument against having Javascript enabled in your browser.

Are there any documented cases where hacks have occurred using recent release of Javascript? I haven't heard of any serious attacks being done through Javascript in recent browsers... but I admit I haven't been actively looking into it. So what's wrong with having Javascript enabled?

In the case of link-exchanges for SEO purposes... the worst thing that I know is possible is that the code they provide could link to a different web location than you thought it was. Is there some greater security risk here I am missing?