4 ms·

The real question here is why is facebook embedding an untrusted widget. They should whitelist youtube, vimeo and all the major content providers and this issue

by rsoto 15y ago

The real question here is why is facebook embedding an untrusted widget. They should whitelist youtube, vimeo and all the major content providers and this issue is effectively gone. I'm real curious about the url facebook is embedding. If it's an iframe, how does facebook tells that it should be embedded?

Timothee 15y ago
At least in 2009, you had to ask Facebook to be whitelisted to be able to see your (the developer's) Flash loaded directly in the timeline. I'm surprised they changed that… They had a form where you would give your domain name, what you were doing, etc. And they took forever to get back to me when I did that.
lbrandy 15y ago
> The real question here is why is facebook embedding an untrusted widget. 1. That's not really the question, at all. The attack works fine w/o flash. Flash just helps reduce friction. I'm pretty certain we've seen versions of the attack that don't use flash. 2. Given #1, it doesn't solve the problem, and it creates a new one. See the other response you received.
- rsoto 15y ago
  I'm not sure it might work without flash, there's no way to copy and paste, at least aside from IE[1]. What I'm arguing is the fact that the widget is embedded. Without it, at least one crucial step will be added (switch back to the previous tab), making the scam way less effective. 1: http://stackoverflow.com/questions/400212/how-to-copy-to-clipboard-in-javascript http://stackoverflow.com/questions/400212/how-to-copy-to-cli... (yeah, it's kinda old, but just check google docs--even in chrome, there's no way to copy something with the menu)
  - mkjones 15y ago
    We've seen the same attack on a 3rd party site that pops up a facebook window that's minimized such that all you can see is the address bar, and has you paste into there. Perhaps a lower conversion rate, but still effective.

by rsoto 15y ago

Timothee 15y ago

At least in 2009, you had to ask Facebook to be whitelisted to be able to see your (the developer's) Flash loaded directly in the timeline. I'm surprised they changed that… They had a form where you would give your domain name, what you were doing, etc. And they took forever to get back to me when I did that.

lbrandy 15y ago

> The real question here is why is facebook embedding an untrusted widget. 1. That's not really the question, at all. The attack works fine w/o flash. Flash just helps reduce friction. I'm pretty certain we've seen versions of the attack that don't use flash. 2. Given #1, it doesn't solve the problem, and it creates a new one. See the other response you received.

rsoto 15y ago
I'm not sure it might work without flash, there's no way to copy and paste, at least aside from IE[1]. What I'm arguing is the fact that the widget is embedded. Without it, at least one crucial step will be added (switch back to the previous tab), making the scam way less effective. 1: http://stackoverflow.com/questions/400212/how-to-copy-to-clipboard-in-javascript http://stackoverflow.com/questions/400212/how-to-copy-to-cli... (yeah, it's kinda old, but just check google docs--even in chrome, there's no way to copy something with the menu)
- mkjones 15y ago
  We've seen the same attack on a 3rd party site that pops up a facebook window that's minimized such that all you can see is the address bar, and has you paste into there. Perhaps a lower conversion rate, but still effective.