5 ms·

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/ http://jsfiddle.net/rVxTn/

jackshepherd 15y ago
Wow - that is quite amazing. I wonder if that's in use in the wild yet. Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&p=1 http://forum.developers.facebook.net/viewtopic.php?id=93201&... Could definitely still be a problem for other social/ad/affiliate networks though.
- jackshepherd 15y ago
  It seems that Facebook has a heuristic where it looks for unusual numbers of retracted 'Likes' and then starts requiring confirmation before logging new Likes. This makes attacks such as these a little less worrying.
- elisee 15y ago
  A similar click-jacking trick is used a lot for spreading videos like worms on Facebook, at least in French. Videos with baiting titles like "How could she do that?", "I can't believe she did this in front of everyone" and such. Most people will click just to see what it might be and not miss out. Then the video player says you have to click on some letters to prove you're not a robot (clever trick, people don't think much of it because it reminds them of CAPTCHAs) The letters actually have Facebook Like button iframes on them with opacity set to 0. I edited the opacity on one of them with the Chrome Dev tools: http://polyprograms.free.fr/tmp/FacebookLikeClickJacking.jpg http://polyprograms.free.fr/tmp/FacebookLikeClickJacking.jpg Unknowningly liking the video will create a story in your friends' feeds, who will in turn click to see and spread it to their friends. No real harm is done except for the spam and all the ad views generated.
- paulgb 15y ago
  It has. When I was at the company, the most common were a string of .info sites that would show a video player chrome and a title like "embarrassing blooper leaves actress topless" or something equally inviting. The video wouldn't exist, but there would be an invisible "like" button behind the play button.
endtwist 15y ago
Even better: http://jsfiddle.net/rVxTn/8/ http://jsfiddle.net/rVxTn/8/ pointer-events: none on an opaque container, with the FB 'like' button below it.
coderdude 15y ago
Great job! I wouldn't mind using this for legitimate reasons. I use custom share buttons on one of my sites and I hate having to use a popup. It's a hack. But this is a sexy hack with better integration.
thekevan 15y ago
In Chrome 16 on Ubuntu Natty, right clicking breaks this.
burgerbrain 15y ago
That more straightforward approach also avoids an unexpected downside of this approach. I never really noticed it before, but my mouse icon is black instead of the apparently usual white. My mouse suddenly turning white on that page makes it pretty clear what is going on.
dkd903 15y ago
I think we can stop worrying. Facebook has a detection mechanism for these false / forced likes :-) http://i.imgur.com/qf7VQ.png http://i.imgur.com/qf7VQ.png

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/ http://jsfiddle.net/rVxTn/

jackshepherd 15y ago

Wow - that is quite amazing. I wonder if that's in use in the wild yet. Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&p=1 http://forum.developers.facebook.net/viewtopic.php?id=93201&... Could definitely still be a problem for other social/ad/affiliate networks though.

jackshepherd 15y ago
It seems that Facebook has a heuristic where it looks for unusual numbers of retracted 'Likes' and then starts requiring confirmation before logging new Likes. This makes attacks such as these a little less worrying.
elisee 15y ago
A similar click-jacking trick is used a lot for spreading videos like worms on Facebook, at least in French. Videos with baiting titles like "How could she do that?", "I can't believe she did this in front of everyone" and such. Most people will click just to see what it might be and not miss out. Then the video player says you have to click on some letters to prove you're not a robot (clever trick, people don't think much of it because it reminds them of CAPTCHAs) The letters actually have Facebook Like button iframes on them with opacity set to 0. I edited the opacity on one of them with the Chrome Dev tools: http://polyprograms.free.fr/tmp/FacebookLikeClickJacking.jpg http://polyprograms.free.fr/tmp/FacebookLikeClickJacking.jpg Unknowningly liking the video will create a story in your friends' feeds, who will in turn click to see and spread it to their friends. No real harm is done except for the spam and all the ad views generated.
paulgb 15y ago
It has. When I was at the company, the most common were a string of .info sites that would show a video player chrome and a title like "embarrassing blooper leaves actress topless" or something equally inviting. The video wouldn't exist, but there would be an invisible "like" button behind the play button.

endtwist 15y ago

Even better: http://jsfiddle.net/rVxTn/8/ http://jsfiddle.net/rVxTn/8/ pointer-events: none on an opaque container, with the FB 'like' button below it.

coderdude 15y ago

Great job! I wouldn't mind using this for legitimate reasons. I use custom share buttons on one of my sites and I hate having to use a popup. It's a hack. But this is a sexy hack with better integration.

thekevan 15y ago

In Chrome 16 on Ubuntu Natty, right clicking breaks this.

burgerbrain 15y ago

That more straightforward approach also avoids an unexpected downside of this approach. I never really noticed it before, but my mouse icon is black instead of the apparently usual white. My mouse suddenly turning white on that page makes it pretty clear what is going on.

dkd903 15y ago

I think we can stop worrying. Facebook has a detection mechanism for these false / forced likes :-) http://i.imgur.com/qf7VQ.png http://i.imgur.com/qf7VQ.png