Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Custom link text can be used for phishing #6532

Closed
dbkr opened this issue Apr 16, 2018 · 9 comments · Fixed by #22286
Closed

Custom link text can be used for phishing #6532

dbkr opened this issue Apr 16, 2018 · 9 comments · Fixed by #22286
Labels
A-URL-Previews O-Occasional Affects or can be seen by some users regularly or most users rarely Security T-Enhancement X-Needs-Design

Comments

@dbkr
Copy link
Member

dbkr commented Apr 16, 2018 •
edited
Loading

Possibly even conditionally whenever link text is, "this", "here", "click here" etc
@lampholder
Copy link
Member

So an option in settings that, when checked, auto-replaces any link posted with link text 'this', 'here', or 'click here' or similar and replaces it with the much-more-enlightening actual URL.

@lampholder lampholder added P1 and removed P2 labels Jun 28, 2018
@lampholder lampholder added P2 and removed P1 labels Jun 29, 2018
@element-hq element-hq deleted a comment from t3chguy Jun 29, 2018
@element-hq element-hq deleted a comment from t3chguy Jun 29, 2018
@element-hq element-hq deleted a comment from lukebarnard1 Jun 29, 2018
@element-hq element-hq deleted a comment from t3chguy Jun 29, 2018
@Twi1ightSparkle
Copy link

Screen Shot 2020-08-17 at 11 45 49 AM

Including for example

/html

<a href="https://google.com">https://bing.com</a>

markdown

[https://bing.com](https://google.com)

Another solution is something similar to what Discord is doing. When you click a link they ask you if you trust the domain and you can allow once or always allow.

@Twi1ightSparkle Twi1ightSparkle changed the title some way to disable rendering of custom link text Custom link text can be used for phishing Aug 17, 2020
@t3chguy t3chguy mentioned this issue Aug 17, 2020
Closed
@Twi1ightSparkle
Copy link

The solution in Element iOS is very nice:
IMG_0379

@babolivier
Copy link
Contributor

ftr that's what Thunderbird also does:

Screenshot from 2020-08-17 14-09-40

@t3chguy t3chguy mentioned this issue Oct 27, 2020
Closed
@dkasak dkasak added the Security label Jan 4, 2021
@t3chguy t3chguy mentioned this issue Jun 23, 2021
Closed
@HarHarLinks
Copy link
Contributor

Depending on your browser, hovering a link shows the target in some status bar, e.g. down below here:
image

On desktop, the only way I know how to preview a URL is to right click, which isn't good enough as it might be cut off after certain length.

In my opinion, a tooltip on hover is also more intuitive for most users. I would like to see that added.

Overall I am sad to see this issue existed for 3.5 years now, and concrete suggestions to prevent clear phishing attempts by checking for url mismatch have been made over a year ago, but as far as I know nothing has been done. Especially since it seems both important (security-relevant) for a system that claims to bolster your privacy, and relatively simple.

@turt2live turt2live mentioned this issue Mar 17, 2022
Closed
@t3chguy t3chguy mentioned this issue Apr 13, 2022
Closed
Johennes added a commit to Johennes/matrix-react-sdk that referenced this issue Apr 22, 2022
@Johennes
Add option to display tooltip on link hover
f18cce8 
This makes it possible for platforms like Electron apps, which lack
a built-in URL preview in the status bar, to enable tooltip previews
of links.

Relates to: element-hq/element-web#6532
Signed-off-by: Johannes Marbach <[email protected]>
@Johennes Johennes mentioned this issue Apr 22, 2022
Merged
@germain-gg germain-gg added O-Occasional Affects or can be seen by some users regularly or most users rarely X-Needs-Design labels Apr 25, 2022
@germain-gg germain-gg mentioned this issue Apr 25, 2022
Closed
Johennes added a commit to Johennes/element-web that referenced this issue May 19, 2022
@Johennes
Enable URL tooltips for Element Desktop
b7c50d0 
Closes: element-hq#6532
Signed-off-by: Johannes Marbach <[email protected]>
@Johennes Johennes mentioned this issue May 19, 2022
Merged
t3chguy added a commit to matrix-org/matrix-react-sdk that referenced this issue Jul 6, 2022
@Johennes @turt2live @t3chguy
Add option to display tooltip on link hover (#8394)
6f21a15 
* Add option to display tooltip on link hover

This makes it possible for platforms like Electron apps, which lack
a built-in URL preview in the status bar, to enable tooltip previews
of links.

Relates to: element-hq/element-web#6532
Signed-off-by: Johannes Marbach <[email protected]>

* Gracefully handle missing platform

* Use public access modifier

Co-authored-by: Travis Ralston <[email protected]>

* Use exact inequality

Co-authored-by: Travis Ralston <[email protected]>

* Document getAbsoluteUrl

* Appease the linter

* Clarify performance impact in comment

Co-authored-by: Travis Ralston <[email protected]>

* Use URL instead of anchor element hack

* Wrap anchor in tooltip target and only allow focus on anchor

* Use optional chaining

Co-authored-by: Michael Telatynski <[email protected]>

* Use double quotes for consistency

* Accumulate and unmount tooltips and extract tooltipify.tsx

* Fix indentation

* Blur tooltip target on click

* Remove space

* Mention platform flag in comment

* Add (simplistic) tests

* Fix lint errors

* Fix lint errors ... for real

* Replace snapshot tests with structural assertions

* Add missing semicolon

* Add tooltips in link previews

* Fix copyright

Co-authored-by: Travis Ralston <[email protected]>
Co-authored-by: Michael Telatynski <[email protected]>
turt2live added a commit that referenced this issue Jul 6, 2022
@Johennes @turt2live
Enable URL tooltips on hover for Element Desktop (#22286)
688dbc6 
* Enable URL tooltips for Element Desktop

Closes: #6532
Signed-off-by: Johannes Marbach <[email protected]>

* Fix access level

Co-authored-by: Travis Ralston <[email protected]>

* Add explicit access level where it exists in base class

* Appease the linker

Co-authored-by: Travis Ralston <[email protected]>
@HarHarLinks HarHarLinks mentioned this issue Jul 7, 2022
Closed
@babolivier
Copy link
Contributor

Bit late to the party, but it doesn't look like #22286 fixes this? I definitely don't think just enabling tooltips on URLs is enough here. cc @t3chguy

@turt2live
Copy link
Member

(please open a new issue with more detailed concerns - reopening this issue would be problematic for the processes in place)

@babolivier
Copy link
Contributor

@turt2live

(please open a new issue with more detailed concerns - reopening this issue would be problematic for the processes in place)

Will do, thanks for the heads up. As a sidenote, I would think that if the processes in place prevent reopening an issue that's been incorrectly closed, then there's something wrong with said processes that needs to be fixed.

@babolivier babolivier mentioned this issue Jul 18, 2022
Open
@babolivier
Copy link
Contributor

I've opened #22875 as continuation of this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
A-URL-Previews O-Occasional Affects or can be seen by some users regularly or most users rarely Security T-Enhancement X-Needs-Design
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Enable URL tooltips on hover for Element Desktop Johennes/element-web
10 participants
@jryans @dkasak @germain-gg @dbkr @turt2live @lampholder @HarHarLinks @babolivier @lukebarnard1 @Twi1ightSparkle