I’m confused how this can be used for phishing?
Does the text only get replaced, and the underlying link stays intact? Surely not?
Otherwise, the link would still go to fedex.com.
back
5 comments
Yes, only the text gets replaced but not the underlying link.
Once you navigate to the link it will be the actual link in the URL bar however.
But this is an easy miss for people after they have already navigated to the link from twitter thinking it's a legitimate link.
Exactly it.
Please use your Microsoft gaming account to login to my phishing site, xbotwitter.com
No, you got that right. Only the displayed text is affected.
> Does the text only get replaced, and the underlying link stays intact? Surely not?
That is exactly what happens.
That’s almost literally unbelievable.
I’m not even sure his nephew is reading W3Schools.
In case you’re reading this, you may have missed this article:
Yeah, looks like _only_ the link label gets replaced, otherwise as you suggest it wouldn't be as bad.
Why do browsers allow this by default? Seems like a feature made to enable phishing and other bad behaviors.
The link I just clicked on to reply to your comment was `https://news.ycombinator.com/reply?id=39991931&goto=item%3Fi...` but thankfully it just said 'reply' in the UI.
I wonder if there's a browser extension that checks if the link text is a valid URL, but is a different URL (or just on a different domain?) than the actual link target, and adds some kind of warning for the user if so?
I'm not sure what keywords I'd use to find an extension like that.
This would break every website that wants to track what links you click on by sneakily rewriting the link under your nose. Which, to be fair, is a use case that I'm all for breaking, but it would make Google mad, so it won't happen.
> This would break every website that wants to track what links you click on
So, a plan with no drawbacks?
> it would make Google mad, so it won't happen.
Google doesn't control which browser extensions get written?