3 ms·
>Another thing that Facebook can do, is detect Wall-spamming and require the user to confirm that (s)he really wants to spam all his/her friends. The XSS code
by eurleif 15y ago
>Another thing that Facebook can do, is detect Wall-spamming and require the user to confirm that (s)he really wants to spam all his/her friends.
The XSS code could just be modified to automatically confirm its actions.
- lancefisher 15y agoNot if it required a captcha.
- eurleif 15y agoThe XSS could change the text explaining the CAPTCHA and socially engineer people into solving it.
- jQueryIsAwesome 15y agoBut then the 'evil script' would select all his friends minus one; or maybe just send messages one by one. The only real way to eradicate this problem is what he is already trying to do: educate the users.
- callahad 15y agoBut at that point, you're already working with a user that's fallen victim to social engineering. The script could likely find a way to present the captchas that would similarly fool the user into completing them.
- mkjones 15y agoThey could just tell the user that the captcha is part of the "security check" the user must do to see if they're in the 2% or whatever. Users will do almost anything if you instruct them well enough.