4 ms·

I'm not sure if this is even possible to fix, given the same-origin policy on iframes. Facebook can't tell where the iframe is placed on the page, and I don't

by bkrausz 16y ago

I'm not sure if this is even possible to fix, given the same-origin policy on iframes. Facebook can't tell where the iframe is placed on the page, and I don't think they can tell if it's 'position:absolute'd. It's a tough problem.

mdwrigh2 16y ago
Sadly, you're right that there isn't a known solution to this yet. If you see my post below, it shows how even if they weren't in an iframe, there are still ways around current framebusting techniques.
vinhboy 16y ago
Without testing, I suggest maybe making the iframe do an "alert" -- "Are you sure you want to Like this page?" One more step, a lot more security. Or at the very least make it easier to find things that you have liked ( I am speaking without actually going to look if its easy to find it... I just remember it was very hard to find the last time I tried )
- bkrausz 16y ago
  Alert boxes tend to be horrible in terms of usability, but it is the only way to actually require a second step, since anything else you do will be constrained to the iframe and you can just clickjack a second time. I think the solution they'll end up implementing (if they do anything) is an "I didn't Like this" link that users can click to report false clicks. If a company gets more than x% of those they get taken down. It's not a legit solution but should be fairly effective.
  - mukyu 16y ago
    They can change the like to a 'pending like' and confirm it next time you check facebook.
    - ctingom 16y ago
      And for "trusted" fan pages they could automatically bypass that.
jpeterson 16y ago
Yes, but perhaps this is a sign of iframe abuse on the part of Facebook and the 3rd party site developers? Placing blame on the browser is pretty lame. The solution to this problem is to not mislead users by embedding one domain's content within another site in the first place.
photon_off 16y ago
My other post describes the fix. I don't have a fancy blog to put up a demo, though.

by bkrausz 16y ago

mdwrigh2 16y ago

Sadly, you're right that there isn't a known solution to this yet. If you see my post below, it shows how even if they weren't in an iframe, there are still ways around current framebusting techniques.

vinhboy 16y ago

Without testing, I suggest maybe making the iframe do an "alert" -- "Are you sure you want to Like this page?" One more step, a lot more security. Or at the very least make it easier to find things that you have liked ( I am speaking without actually going to look if its easy to find it... I just remember it was very hard to find the last time I tried )

bkrausz 16y ago
Alert boxes tend to be horrible in terms of usability, but it is the only way to actually require a second step, since anything else you do will be constrained to the iframe and you can just clickjack a second time. I think the solution they'll end up implementing (if they do anything) is an "I didn't Like this" link that users can click to report false clicks. If a company gets more than x% of those they get taken down. It's not a legit solution but should be fairly effective.
- mukyu 16y ago
  They can change the like to a 'pending like' and confirm it next time you check facebook.
  - ctingom 16y ago
    And for "trusted" fan pages they could automatically bypass that.

jpeterson 16y ago

Yes, but perhaps this is a sign of iframe abuse on the part of Facebook and the 3rd party site developers? Placing blame on the browser is pretty lame. The solution to this problem is to not mislead users by embedding one domain's content within another site in the first place.

photon_off 16y ago

My other post describes the fix. I don't have a fancy blog to put up a demo, though.