Obviously, something is going on with some default initialization of the objects in the DOM when the page loads. I've tried to capture this and override it in several different ways, but have been remarkably unsuccessful. So either my logic is poor, my documentation is lacking, it's not allowed (hard to fathom), or all three. I'd love to hear from someone about how to get at the onmousedown override when the page loads and before the first mousedown event is processed.

Now the initial impetus for all of this was a security issue. The solution thus far seems somewhat lacking, probably due to a "feature" (or lack thereof) in the browser itself. So, we're back to the old engineering trade-off paradigm. I imagine most people don't hold down the mouse button on a link to see if some secure information shows up. They simply hover over it. We can cover the latter case, but not the former. Yet the status bar often shows useful information, such as progress information. It seems to me the risk is small; I'd go with keeping the status bar and hiding the secure link information under normal circumstances. If someone is sophisticated enough to know to hold the mouse button down, they likely have other means to attack your system. In the web application on which I am currently working, the client has finally decided that the page will not hide the status information; QA would just stop reporting it as a problem…