Loose clicks invite hacker tricks