how far can javascript go?

I am still learning all of this and am not up on javascript as much as I should be, but I do have a question regarding its capabilities.

The question is can javascripts in the wrong hands implement permanent changes to a users system? I know about the sandbox theory Sun advertises but I have heard comments which led me to ask.

I know javascript can’t reformat a hard drive or do other virus activities, but can it change a browsers homepage or initiate other changes the user may not want?

What prompted me to ask this is there is a lot of concern on the Ebay message boards these days. Every scam artist in the world has targeted Ebay users recently and the con is to send fraudulent email to users that is indistinguishable from ebay’s.

The scare is that hitting the link on this email will take you to a site where the user could have a key mapper program or some other spyware loaded on their machine that security software might not detect.

The reason I am asking is the site I am working on uses a reasonable amount of javascript. My concern is if users see this as a threat they will disable java and kill most of the features like mortgage calculators, etc.

So how far can javascript really go?

If it can change browser home pages or other settings without the users consent, it is going to be disabled by most people as soon as word gets out.

Years ago there were some potential security problems, but those have all be removed. Most everyone (as far as I know) has javascript enabled. (note that java and javascript are two different things, and from what you say i'm thinking you're talking javascript)

that's correct- I am referring only to javascript

You can't change a browser's homepage - In all browsers I know, it asks you if you want to change your homepage ( I believe ). Javascript has been used for so long and so widely that I don't think there are many (if any) security problems that remain.

With regards to ebay - That problem is not a javascript problem as far as I'm aware, but probably a problem with activex controls or the like. Javascript can't "install" anything on your system. It can probably log keypresses...but only for the page you're on.

Another reason I was asking is I was on a javascript site and a poster was saying he had completed a script which would change a users homepage without asking. And that he would post it soon.

A lot of the people over there were pretty excited about being able to do that. I just did not know if the guy was full of it or not.

I think it was on javascript.com that I saw the message.

Actually I have had my homepage changed without me wanting it to be changed... I think it's more of a spyware thing. Because Every JavaScript I have ever seen can't Force me to bookmark a page.

Also, as for the e-bay thing. I have heard of some recent scams , and from what I heard they were posting fake e-bay bids and when the person clicks the email (that looks like its from ebay) it take's them to a page that looks identical and asks them to log-in. They are then taking that information and stealing people's accounts. This almost happened to my dad, but luckily I was there and warned him about the Location of the page he was at... It wasn't www.ebay.com , but some other link.

The technical term for that type of email scam is "phishing". It has nothing to do with javascript.

You need to read up on the difference between the client and the server, and the capabilities of each.