Safety and Bookmarklets ...should we lose sleep over this?

Using Explorer 5, when you drag a bookmarklet to your Links toolbar a message pops up that says "this may not be safe" and asks if you want to continue. This message probably puzzles a lot of people because it does not explain why or when a bookmarklet may or may not be safe. It's like being told, when you're buying a car, that somewhere on the road ahead there may be some kind of trouble. Preferably you'd rather know a lot more about the kind of trouble (falling rocks? slippery turns?) and, if at all possible, see the warning sign a lot closer to the danger. So I feel compelled to fill this gap; to explain about bookmarklets and safety. First, for those in a hurry, the danger level is below that of mischief and nuisance. All bookmarklets at bookmarklets.com are safe, every other bookmarklet I've ever seen is safe, and it is very likely that every bookmarklet you will see during the next few years (especially from popular sites) will be safe. So what's the concern? The concern arises whenever we trust someone else to make a tool for us; what if the tool does something other than expected? In this case, bookmarklets are tools that work with the data on the page you are viewing, so, simply put... if you are not sure whether or not a bookmarklet is safe, you can eliminate all danger by not triggering the bookmarklet while you are in websites or pages where you have entered sensitive data such as your credit card number, password, personal data, etc. The majority of web browsing is anonymous... and bookmarklets can always be safely used then. Let me defend the claims made above: 1.) Bookmarklets at bookmarklets.com are safe.   Bookmarklets are built from JavaScript, so the "source code" is always readable (sometimes annoyingly so). That means that knowledgable scripters can see exactly what the bookmarklet is doing. With the level of scrutiny at bookmarklets.com, we'd have to be damn fools to try anything sneaky, and besides, our mission is to promote this technology, not to hurt people with it. Every bookmarklet received and published at bookmarklets.com is scrutinized - mainly because we love reading these things, which are like "programming haikus" - and no sneakiness is allowed. You can use these anywhere. 2.) Every bookmarklet I've seen is safe.   I've seen many bookmarklets made by other people. As a rule, I'd say they all fall into one of three categories: Bookmarklets created by web services which extend the usability of these services. Bookmarklets created by scripters who are delighted to create clever and useful new scripts. Bookmarklets created by people who have found a solution which they want to share. In each of these cases, there are significant benefits for the creators if they provide a good and useful tool, and significant risks if they try anything sneaky, because others can read their source code. It would be very foolish for a popular site to risk the embarrassment of detection when the potential reward is so small. Which brings me to my third claim... 3.) Every bookmarklet you see during the next few years is likely to be safe.   The reason I'm so confident here is that the potential for sneakiness is rather limited. It's really hard to get much sneakiness into the limited size of current bookmarklets, and it can only be rewarded if the user happens to trigger the bookmarklet while sitting on a particular page. So the strategy for the criminal here could be compared to this: go far into the forest and hide behind a tree, hoping you won't be seen - if someone walks into that part of the forest and happens to lean his arm against that particular tree, grab his arm and take his valuables. Needless to say, such a strategy would be idiotic. So we have little need to fear the criminal here - he will find more lucrative pursuits (such as stealing coins from wishing wells) - and instead we need only fear the idiot. But idiots are not known for their JavaScript skill. Having said that, we can look forward to a time when bookmarklets are bigger, when very complex processes can be shared through them; we can't expect the imperfection of the current implementation to protect us forever. So you should know that when you use a tool which processes the data on a page then that data becomes exposed to the tool. If you have reason to distrust the tool, you should not use it after you've put sensitive data (e.g. your credit card number) onto the page. It would be nice if one could be reminded of this in situations where it would make a difference. If the big trees along the more travelled paths were able to post a warning sign when they needed it, then the idiot would have no good tree to hide behind. It would be one extra measure of security which responsible sites could provide (much the way they use "password fields" now). I hope this discussion, a little vague I know, has been clear enough to convince you that using tools on webpages is really not so dangerous, but that if you must worry about it then there are simple precautions you can take. Steve Kangas Nov. 24, 2000