Link Reveal

About

Phishing is a significant cybersecurity problem associated with Social Engineering exploits.  Social Engineering exploits rely on human error. 

Users are expected to examine the links on a web page by hovering over them to view the contents of the "href" attribute and determine if it is safe to navigate by clicking them. 
Anchor tags are used by web developers to create buttons and use "onclick" events to call JavaScript.  The unknowns in this situation are: 1) Where is the JavaScript located that will be executed?  and 2) What is the JavaScript programmed to do?

This extension reads the web page source and reports on the attributes of the anchor tags.   It also analyzes the use cases that might indicate a problem with clicking on the link if the expectation is to navigate to a secure web page.

The source code for this extension contains a README that advises how to use the extension and how to interpret the results.  

You can view the Readme and source code here:
https://github.com/rebeccapeltz/link-reveal-ext

The manifest indicates that the code in this Version 3 extension can be run on all web pages.  This is because the extension uses only one DOM command to obtain data from a web page, which can be found in the content.js code.  This command is: 

"document.getElementsByTagName("a");".  

The data from this command is analyzed, and the output is shown in the popup window.  None of the data is stored locally or anywhere else.

It would be wonderful if this functionality were available as a feature in all browsers. Many users are not familiar with HTML elements and their attributes. The numerous variations on how an anchor tag can be coded make it even more difficult for a user to be confident that they are dealing with a secure link. When users discover that they have become victims of a phishing attempt and report it to an authority that can help them resolve problems arising from the attack, they are often blamed: “Why did you click on that?” A tool like this might help them avoid being "phished" on the web.