On: Using the HTML5 Fullscreen API for Phishing Attack...

[damncabbage]

  The user can hover their mouse over the link and their 
  status bar will show https://www.bankofamerica.com, as 
  expected.

Google search results use a similar technique to show you the "right" link when you hover.

(It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

[guelo → damncabbage]

This is pissing me off. The link hover should be sacred, browsers shouldn't allow any trickery there.

[finnw → guelo]

I won't be surprised if both Google and MS restrict this in their browsers in the near future, but make exceptions for their own search engines.

[oliciv → finnw]

I won't be holding my breath for major browsers to remove support for JS click events!

[finnw → oliciv]

Probably not, but if a regular link has an onClick event, they might show a big red warning message in the status bar in place of the URL.

[vilgax → guelo]

For Google Search use this userscript http://userscripts.org/scripts/show/121923 Work in FF & Google Chrome.

[peterjmag → damncabbage]

That's not what's happening here though. The JS in the demo doesn't change the href attribute of the link, it just adds an event handler that prevents the real link from loading using e.preventDefault() and then triggers full screen.

[damncabbage → peterjmag]

Sorry, I wasn't very clear; I'm just saying that both this and Google Search spoofs the status bar by obscuring what a link will do until it's clicked.

[ben0x539 → damncabbage]

This was really annoying for me because somehow the google redirect link took a lot longer to load than the ultimate destination would, or even regular google pages.

[chii → ben0x539]

and it also stops copy/paste link via a right click (at least, that didnt work last time i tried)

[vilgax → ben0x539]

For Google Search use this userscript http://userscripts.org/scripts/show/121923 Works in FF & Google Chrome.

[feross → damncabbage]

Yep. Try Right Click > Copy Link Address. It copies the google.com/... redirect link, which is how I first learned that they were doing this.

[damncabbage → feross]

To see how it works:

* Open a search in Chrome, and open up the Inspector (making sure not to right-click any links you want to inspect),

* Find an <a href="..."> tag for a search result.

* Right-click the tag in the Inspector, go Break On... => Attributes Modifications.

* Right-click the link like you usually would to copy it, and see what happens.