7 ms·

That URL itself doesn't perform the action -- that page has a button that, when clicked, submits a form with POST. That is when the action happens. In addition,

by jpadvo 16y ago

That URL itself doesn't perform the action -- that page has a button that, when clicked, submits a form with POST. That is when the action happens. In addition, it appears that they have taken steps to prevent CSRF. So no, it probably isn't a security issue. Just a flamingly idiotic interface issue that is causing some developers to lose their apps and waste massive amounts of time. [Edit: Haha, finding and exploiting a security vulnerability would be an effective way to get attention, but it would definitely not be nice to all the people who would get messed up by it. I figure a HN post is a more constructive method. ]

catshirt 16y ago
also it does say "WARNING: Test accounts CANNOT be converted back to normal accounts and they are not allowed to access the Developer App." in bold above the button. not excusing them, but they did seem to make some effort.
- jpadvo 16y ago
  You are completely right. I admit that I wasn't paying a lot of attention. I was in a mode of scanning-documentation-trying-to-figure-something-out. I didn't think that poking around the developer center could destroy my account. Obviously I was wrong, and I'm kicking myself now. But still, it is absolutely stupid to make it that easy to wreck your account. Because much of the time, users won't pay attention to paragraphs of text you put around prominent links and buttons. [Edit] Also, the button says "Make Your Name a Test Account." I thought it was going to make a test account for me, not from me.
  - dalke 16y ago
    Which is how most people operate. It is the obligation of the interface designer to take into account that people rarely read the instructions.
    - mryan 16y ago
      This is only true up to a point - perhaps not when referring to instructions about how to interface with APIs or otherwise develop custom content for the site. Indeed, people rarely read instructions - but sometimes they read them and misinterpret them, which is what I think happened here. I still think FB should make you confirm by clicking a button though, especially if there is no way to return your account to its normal state.
  - mryan 16y ago
    While I would also be quite irate if I was in your position, it does not sound like this can be blamed entirely on FB. My first parsing of "Make <your name> a Test Account" is that it means "the FB account with <your name> will be converted from a real account in to a test account". Also, > "To make a test account, register on Facebook as you normally would. Then, when logged in to the test account, go to this URL" That also seems quite clear to me: Create a test account Log in to the test account Click "Make <your name> a Test Account" That being said, I do agree - this should have required more confirmation. This could have been avoided with a simple message box saying "Hold up, are you sure? <Your name> will no longer be a normal FB user. All <Your name's> friends will be deleted, and you will not be able to admin any apps. If you want a test account in addition to your normal account, you need to..."
    - encoderer 16y ago
      While I'm sympathetic to that being your first parsing, it certainly seems a bit off to me. For example, if you pressed a button saying "Make myran a Cake" you probably would expect it to give you a cake. If it made you INTO a cake, you'd probably be in tiers. (Sorry, couldn't resist.)
      - thalur 16y ago
        I'm not sure your example works because one would not normally expect a person to be turned into a cake, so the "give you a cake" reading is going to seem much more plausible. If the button said "Make myran a genius", what would you expect to happen?
      - mryan 16y ago
        Like thalur says, the cake analogy is not entirely accurate, but you make a good point - the phrasing of the statement is ambiguous, and could be taken to mean two different things: Convert <item> in to <an object> Create <an object> belonging to <item> Given the ambiguity, FB should probably tweak the wording to make it as obvious as possible. Off-topic, but I am always impressed with how people share differing viewpoints on HN. It actually feels like a "forum" in the original sense of the word, instead of a shouting match between warring egos with something to prove.
paolomaffei 16y ago
You can still clickjack it, can't you?
- jpadvo 16y ago
  Probably not, because pages inside Facebook proper don't display inside frames. Despite some terrible failings with providing support to the human beings who use their services, they've got good engineers doing security. :)
jbri 16y ago
If you linked to the page with the button itself, and labelled the link something like "go here to sign up for the beta test of {awesomeapp}", you would probably get a massive number of people clicking it.
- jpadvo 16y ago
  Clever idea -- human engineering can get past any kind of software security. But I don't want fix this problem for myself by dragging more people into the pain. Thanks for trying to help, though.

by jpadvo 16y ago

catshirt 16y ago

also it does say "WARNING: Test accounts CANNOT be converted back to normal accounts and they are not allowed to access the Developer App." in bold above the button. not excusing them, but they did seem to make some effort.

jpadvo 16y ago
You are completely right. I admit that I wasn't paying a lot of attention. I was in a mode of scanning-documentation-trying-to-figure-something-out. I didn't think that poking around the developer center could destroy my account. Obviously I was wrong, and I'm kicking myself now. But still, it is absolutely stupid to make it that easy to wreck your account. Because much of the time, users won't pay attention to paragraphs of text you put around prominent links and buttons. [Edit] Also, the button says "Make Your Name a Test Account." I thought it was going to make a test account for me, not from me.
- dalke 16y ago
  Which is how most people operate. It is the obligation of the interface designer to take into account that people rarely read the instructions.
  - mryan 16y ago
    This is only true up to a point - perhaps not when referring to instructions about how to interface with APIs or otherwise develop custom content for the site. Indeed, people rarely read instructions - but sometimes they read them and misinterpret them, which is what I think happened here. I still think FB should make you confirm by clicking a button though, especially if there is no way to return your account to its normal state.
- mryan 16y ago
  While I would also be quite irate if I was in your position, it does not sound like this can be blamed entirely on FB. My first parsing of "Make <your name> a Test Account" is that it means "the FB account with <your name> will be converted from a real account in to a test account". Also, > "To make a test account, register on Facebook as you normally would. Then, when logged in to the test account, go to this URL" That also seems quite clear to me: Create a test account Log in to the test account Click "Make <your name> a Test Account" That being said, I do agree - this should have required more confirmation. This could have been avoided with a simple message box saying "Hold up, are you sure? <Your name> will no longer be a normal FB user. All <Your name's> friends will be deleted, and you will not be able to admin any apps. If you want a test account in addition to your normal account, you need to..."
  - encoderer 16y ago
    While I'm sympathetic to that being your first parsing, it certainly seems a bit off to me. For example, if you pressed a button saying "Make myran a Cake" you probably would expect it to give you a cake. If it made you INTO a cake, you'd probably be in tiers. (Sorry, couldn't resist.)
    - thalur 16y ago
      I'm not sure your example works because one would not normally expect a person to be turned into a cake, so the "give you a cake" reading is going to seem much more plausible. If the button said "Make myran a genius", what would you expect to happen?
    - mryan 16y ago
      Like thalur says, the cake analogy is not entirely accurate, but you make a good point - the phrasing of the statement is ambiguous, and could be taken to mean two different things: Convert <item> in to <an object> Create <an object> belonging to <item> Given the ambiguity, FB should probably tweak the wording to make it as obvious as possible. Off-topic, but I am always impressed with how people share differing viewpoints on HN. It actually feels like a "forum" in the original sense of the word, instead of a shouting match between warring egos with something to prove.

paolomaffei 16y ago

You can still clickjack it, can't you?

jpadvo 16y ago
Probably not, because pages inside Facebook proper don't display inside frames. Despite some terrible failings with providing support to the human beings who use their services, they've got good engineers doing security. :)

jbri 16y ago

If you linked to the page with the button itself, and labelled the link something like "go here to sign up for the beta test of {awesomeapp}", you would probably get a massive number of people clicking it.

jpadvo 16y ago
Clever idea -- human engineering can get past any kind of software security. But I don't want fix this problem for myself by dragging more people into the pain. Thanks for trying to help, though.