It isn't your homenode that you should be worried about. My homenode could easily contain javascript to steal your PM password (or any number of other things). And I might fool you into visiting it.

Fairly recently we changed the defaults such that most foreign javascript doesn't work (by default). See Tidings.