Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> You can't even trust the browser's link preview tooltip because it can be overridden in JS.

What!? Just tooltip, or status bar also?



I'm talking about the "preview" usually at the bottom left of the browser when you hover a link. By using a Javascript event handler on the link you can override what happens.

Google does that for instance, if you hover on top of a search result it'll look like a direct like to the website, however if you look at the HTML source it looks something like this:

    <a href="https://en.wiktionary.org/wiki/test" onmousedown="return rwt(this,'','','','2','AFQjCNHdfeYp_b4PzYbkDh9qequUqhrOQw','','0ahUKEwjmkPK0qfrUAhVD2hoKHSc9DG0QFggwMAE','','',event)">test - Wiktionary</a>
So even though the href goes to wikipedia in this case if I click the link the browser goes to a google page that then redirects me.

You can see the real URL by right-clicking on the link and then hovering again, it causes the "onmousedown" code to run and replace the href by the real value.

Duckduckgo uses a "click" event handler instead. As far as I can't tell Bing doesn't do anything and directly links the target website, which is odd. I may be missing something.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: