mkjones

16 ms·

1. 181.▲
   by mkjones 16y ago

   It seems I can't reply to your post (max HN thread depth = 5?), so I'll do it here... I believe the like:impression ratio for clickjacking sites isn't different enough from the (noisy) norm to make it a usable metric for identifying malicio
2. 182.▲
   by mkjones 16y ago

   I think that in the current state we have pretty robust protection against these attacks. If we see people bypassing it, we'll have to change our tactics :-). Both of your suggestions are good, but require us being able to run javascript o
3. 183.▲
   by mkjones 16y ago

   The idea of detecting if X and Y are changing while the cursor is over the button is a good one and actually something we thought about. While it does help mitigate the case where the attacking site dynamically moves the iframe, it's relat
4. 184.▲
   by mkjones 16y ago

   This is Matt Jones, an engineer on the site integrity team at Facebook. We're the ones who address issues like this one on Facebook. Ultimately clickjacking / UI redress is a browser vulnerability - it shouldn't be possible to display one t
5. 185.▲
   by mkjones 17y ago

   Hey folks - as people have pointed out, this is actually just a hoax. Facebook is not launching a "Pro" version. This blog's author has a page at http://cd34.com/facebook/ which explains that the idea is a joke to get media attention: "