2

Is it possible to use http://toread.cc without having to use a bookmarklet? This is a website which will e-mail webpages of your choosing to you. The only way to use it though is with a boomarklet. Could somebody look in the javascript code of the bookmarklet and possibly find a workaround so that I won't have to use a bookmarklet? I have heard that bookmarklets are unsafe.

1
  • Leaving your email address there might be more of a risk than using a bookmarklet. (But indeed, especially when a bookmarklet loads JavaScript code whenever clicked, like "The Printliminator" at css-tricks.com/examples/ThePrintliminator, then one day it could be changed into something that reads your cookies or whatever.)
    – Arjan
    Nov 2, 2009 at 15:37

1 Answer 1

1

The bookmarklet is a bit hidden, as it is dynamically generated after one confirms their email address (by clicking a link in an email message one gets). It looks like this:

javascript:(function(){
  var s = document.createElement("scr" + "ipt");
  s.charset = "UTF-8";
  s.language = "javascr" + "ipt";
  s.type = "text/javascr" + "ipt";
  var d = new Date;
  s.src = "http://toread.cc/bjs.php?s=SOME_PERSONAL_ID&d=" 
    + d.getMilliseconds();
  document.body.appendChild(s)
})();

The above is a pretty standard way to load some external JavaScript each time it's clicked.

That external script uses some personal ID to know to which email address to send the result. Today, that JavaScript does not look very harmful: it sends the HTML source code of the page you're viewing to the toread's servers, which will then send the email. So, the HTML source code will be known to toread, implying one should be careful using this for very personal sites.

But: the external JavaScript could change. Worse: if the value of that personal id can easily be guessed, then spammers could send their page to random users of this service. But today, that personal ID is a 12 digits hexadecimal code, so I doubt it's just an incrementing number that anyone can randomly try.

One cannot know if/when the external JavaScripts needs to be reloaded after something changed on the toread's servers. So, to answer your question: one should not use this service without getting the latest version of that external JavaScript. Hence, getting rid of the bookmarklet does not make a lot of sense either. Today, it does not look harmful though.

You must log in to answer this question.