What can happen after clicking on a malicious link?

Question

Information Security

The question is probably funny, but I can't understand why so many people say that you should never click on unfamiliar links. Can anything happen after the transition? The site cannot run any code on the user's computer, cannot access the list of passwords stored in the browser. The maximum is to show some content and prompt the user to download some file.

Then what is the danger of visiting unfamiliar sites?

Answer 1

* deanonymization , at least the site learns your ip address (and approximate geographic coordinates from it), users of telegram and other anonymous chats often forget about this
* spam through notifications , sites ask for permission to receive notifications (sometimes cyclically until you click yes) and after a while you will have pop-up windows with pictures (ads)
* attacking vulnerable web services where you are authorized - click jacking (blindly force you to click buttons on an authorized site, drawing it with 100% transparency in an iframe, moving it under the user's cursor), cross site scripting (perform actions on sites by calling requests directly there)
* there is a danger of accessing the clipboard, the fact is that, according to the standard, the browser does not have direct access to the buffer until the user performs an action on the site (mouse click), it is not difficult to force the user to do this, and the content of the buffer will be at the malicious site, and what is there in your buffer sometimes - sometimes very interesting
* phishing - slip a visual copy of other services, require authorization and thus fish out the login password
* many people allow (default behavior of browsers) automatic download of filesinto the download directory, a malicious site can slip a legitimate application infected with a Trojan into it, in the hope that the user will someday run it when he sees it in the download folder (there is always a mess and no one remembers where they downloaded from), in fact, this is one of the most dangerous actions, as it transfers operations from the browser sandbox to the operating system, and there vulnerabilities are more dangerous
...