3 ms·
Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given: if (disp
by GeneralMayhem 10y ago
Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given:
if (display_domain == landing_page_domain)
{
approve_ad = true;
}else{
approve_ad = false;
}
is, for one thing, not robust against cloaking (if malicious advertisers see the request coming from a Facebook IP, they might actually redirect to the displayed domain).
- davedx 10y agoHe clearly states that security is about raising the bar as high as you can. You can't build a bulletproof system, but you can make systems that are not trivial to game.
- GeneralMayhem 10y agoRedirecting based on client IP is trivial for anyone with sufficient resources to have put together that ESPN clone in the first place.
- mevile 10y agoFacebook could obviously detect the HTTP redirect.
- zeta0134 10y agoThey can detect that a redirect has happened, but not the logic that determined which destination to display. If a redirect happens no matter what (this is very, very common for advertisement landing pages to track campaign visibility) then the presence of one is not necessarily malicious.
- Cpoll 10y agoFacebook could probably check periodically from a separate IP (secret-shopping, if you will) and pull the URLs that don't comply. Of course, it'd probably turn into an arms race as malicious advertisers try to profile FB's bot behavior and properly redirect it. That is to say, I agree with you, the problem is non-trivial.
- eonw 10y agothis is a shared service and the operators of this service have gotten pretty good at catching FB when they do this... they will just add the last 10 IPs that saw the banned ad, to their list of IPs to only show a "safe" page to. then everyone paying into the service has that rule.
- jfoster 10y agoSure, it's difficult to make this 100% fail proof, but I think the point of the article is that even the most basic of checks are missing.
- DrScump 10y agoTo start with, how about adding a frequently-monitored "Report this Ad" feature? It's not rocket surgery.
- legulere 10y agoLike you say it could be circumvented, but facebook doesn't try even that (the blog author tried it himself/herself and didn't need any circumvention techniques)
- scottmf 10y agoWhy not simply verify domain ownership? You could select a display domain from your list of verified domains.