-14

There are unfortunately people who would seek to post disguised malicious links on Stack Exchange sites with the hopes of catching potential high (or low) value targets off-guard. For example say someone responded to a question with:

In order to frob this widget you'll have to look at the docs for frobber https://docs.frobber.com

or:

... there are more details on the implementation of PotatoBasket in this answer https://stackoverflow.com/a/73160331/16450169

as of now a user simply leaves the site without warning. It seems relatively trivial to at least add a popup that displays something like:

CAUTION: You are leaving https://stackoverflow.com for https://phishing-site.com. Would you like to proceed? [y/n]

Of course proper moderation should prevent this kind of thing, but is that enough? Should there be another layer of defense?

Improve this question
4
  • 7
    in theory our main line of defence is folks flagging/editing those links
    – Journeyman Geek Mod
    Jul 29 at 2:07
  • @JourneymanGeek and I think the network overall does a good job doing that, but it seems sensical to give the user the final decision to leave a site?
    – 0x263A
    Jul 29 at 2:16
  • 9
    There's already a primary line of defense, which is the URL your browser displays when you mouse over the link. It's basic internet use that you should be verifying the URL that your browser independently displays for any link that you're thinking of clicking on. There are things sites can do to make what the browser displays be unreliable, but doing so primarily requires using JavaScript running in the page, which posts don't have access to, other than in snippets (which you should be treating as fully untrusted).
    – Makyen
    Jul 29 at 2:28
  • 10
    Personally, I associate popups like the type you're suggesting more with sites that are trying to make me stay on their site, in order to make money off of me, substantially more strongly than I do with a site trying to be helpful (although there are some sites that do it in ways which appear to be trying to be helpful rather than greedy). When I see such a popup, I usually see it as an indication that I should definitely leave that site ASAP, as they are likely to be doing other things to monetize me/my use of the site/my data/etc.
    – Makyen
    Jul 29 at 2:34

1 Answer 1

Reset to default
13

No, we should not have such a warning.

As for your claim:

There are unfortunately people who would seek to post disguised malicious links on Stack Exchange sites with the hopes of catching potential high (or low) value targets off-guard.

I challenge you to find such posts that are not yet flagged, have pending edits or are otherwise in the process of being deleted.

The sites in the Stack Exchange Network are highly moderated by their community members and their elected diamond moderators. We don't have to guard our users for clicking malicious links because malicious links are dealt with the moment we spot one, as opposed to many if not all other internet sites that accept user generated content.

We have had mishaps (ImageShack anyone?) with links to external domains but even those major incidents were resolved with community effort.

For the record, Smoke Detector does detect posts that contain links, both the disguised ones as well as those to doubtful domains, and once reported they are dealt with swiftly, partially with automatic flags.

Improve this answer
1
  • I will not pick up the gauntlet you've thrown down as I agree that community members and moderators do a great job maintaining Stack Exchange sites. I had considered this angle but was worried about the time between "community member reports link" and "moderator takes action", but I also did not know about Smoke Detector. I think there's plenty of anecdata for the communities ability to respond to "mishaps".
    – 0x263A
    Jul 29 at 17:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .