4 ms·

http://vinhboy.com/blog/2010/05/31/facebook-man-with-the-biggest-trick/ http://vinhboy.com/blog/2010/05/31/facebook-man-with-the-big... I also wrote about this

by vinhboy 16y ago

http://vinhboy.com/blog/2010/05/31/facebook-man-with-the-biggest-trick/ http://vinhboy.com/blog/2010/05/31/facebook-man-with-the-big... I also wrote about this like 2 months ago, and they still haven't done anything about it... =(. Facebook CTO guy, are you around today?

bkrausz 16y ago
I'm not sure if this is even possible to fix, given the same-origin policy on iframes. Facebook can't tell where the iframe is placed on the page, and I don't think they can tell if it's 'position:absolute'd. It's a tough problem.
- mdwrigh2 16y ago
  Sadly, you're right that there isn't a known solution to this yet. If you see my post below, it shows how even if they weren't in an iframe, there are still ways around current framebusting techniques.
- vinhboy 16y ago
  Without testing, I suggest maybe making the iframe do an "alert" -- "Are you sure you want to Like this page?" One more step, a lot more security. Or at the very least make it easier to find things that you have liked ( I am speaking without actually going to look if its easy to find it... I just remember it was very hard to find the last time I tried )
  - bkrausz 16y ago
    Alert boxes tend to be horrible in terms of usability, but it is the only way to actually require a second step, since anything else you do will be constrained to the iframe and you can just clickjack a second time. I think the solution they'll end up implementing (if they do anything) is an "I didn't Like this" link that users can click to report false clicks. If a company gets more than x% of those they get taken down. It's not a legit solution but should be fairly effective.
    - mukyu 16y ago
      They can change the like to a 'pending like' and confirm it next time you check facebook.
      - ctingom 16y ago
        And for "trusted" fan pages they could automatically bypass that.
- jpeterson 16y ago
  Yes, but perhaps this is a sign of iframe abuse on the part of Facebook and the 3rd party site developers? Placing blame on the browser is pretty lame. The solution to this problem is to not mislead users by embedding one domain's content within another site in the first place.
- photon_off 16y ago
  My other post describes the fix. I don't have a fancy blog to put up a demo, though.
drivebyacct2 16y ago
I'm happy to upvote your comment. This is way old news, its funny because even my tech friends are getting ensnared by it.
finiteloop 16y ago
Yes, I am here, and so is someone who is more knowledgable than I am: http://news.ycombinator.com/item?id=1513470 http://news.ycombinator.com/item?id=1513470

by vinhboy 16y ago

bkrausz 16y ago

I'm not sure if this is even possible to fix, given the same-origin policy on iframes. Facebook can't tell where the iframe is placed on the page, and I don't think they can tell if it's 'position:absolute'd. It's a tough problem.

mdwrigh2 16y ago
Sadly, you're right that there isn't a known solution to this yet. If you see my post below, it shows how even if they weren't in an iframe, there are still ways around current framebusting techniques.
vinhboy 16y ago
Without testing, I suggest maybe making the iframe do an "alert" -- "Are you sure you want to Like this page?" One more step, a lot more security. Or at the very least make it easier to find things that you have liked ( I am speaking without actually going to look if its easy to find it... I just remember it was very hard to find the last time I tried )
- bkrausz 16y ago
  Alert boxes tend to be horrible in terms of usability, but it is the only way to actually require a second step, since anything else you do will be constrained to the iframe and you can just clickjack a second time. I think the solution they'll end up implementing (if they do anything) is an "I didn't Like this" link that users can click to report false clicks. If a company gets more than x% of those they get taken down. It's not a legit solution but should be fairly effective.
  - mukyu 16y ago
    They can change the like to a 'pending like' and confirm it next time you check facebook.
    - ctingom 16y ago
      And for "trusted" fan pages they could automatically bypass that.
jpeterson 16y ago
Yes, but perhaps this is a sign of iframe abuse on the part of Facebook and the 3rd party site developers? Placing blame on the browser is pretty lame. The solution to this problem is to not mislead users by embedding one domain's content within another site in the first place.
photon_off 16y ago
My other post describes the fix. I don't have a fancy blog to put up a demo, though.

drivebyacct2 16y ago

I'm happy to upvote your comment. This is way old news, its funny because even my tech friends are getting ensnared by it.

finiteloop 16y ago

Yes, I am here, and so is someone who is more knowledgable than I am: http://news.ycombinator.com/item?id=1513470 http://news.ycombinator.com/item?id=1513470