Hacker News Reader

Comment by duopixel | Hacker News Reader

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/

View on HN

Even better: http://jsfiddle.net/rVxTn/8/

pointer-events: none on an opaque container, with the FB 'like' button below it.

Wow - that is quite amazing. I wonder if that's in use in the wild yet.

Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&...

Could definitely still be a problem for other social/ad/affiliate networks though.

A similar click-jacking trick is used a lot for spreading videos like worms on Facebook, at least in French. Videos with baiting titles like "How could she do that?", "I can't believe she did this in front of everyone" and such.

Most people will click just to see what it might be and not miss out. Then the video player says you have to click on some letters to prove you're not a robot (clever trick, people don't think much of it because it reminds them of CAPTCHAs)

The letters actually have Facebook Like button iframes on them with opacity set to 0. I edited the opacity on one of them with the Chrome Dev tools:

http://polyprograms.free.fr/tmp/FacebookLikeClickJacking.jpg

Unknowningly liking the video will create a story in your friends' feeds, who will in turn click to see and spread it to their friends. No real harm is done except for the spam and all the ad views generated.

It seems that Facebook has a heuristic where it looks for unusual numbers of retracted 'Likes' and then starts requiring confirmation before logging new Likes.

This makes attacks such as these a little less worrying.

It has. When I was at the company, the most common were a string of .info sites that would show a video player chrome and a title like "embarrassing blooper leaves actress topless" or something equally inviting. The video wouldn't exist, but there would be an invisible "like" button behind the play button.

That more straightforward approach also avoids an unexpected downside of this approach. I never really noticed it before, but my mouse icon is black instead of the apparently usual white. My mouse suddenly turning white on that page makes it pretty clear what is going on.

Great job! I wouldn't mind using this for legitimate reasons. I use custom share buttons on one of my sites and I hate having to use a popup. It's a hack. But this is a sexy hack with better integration.

In Chrome 16 on Ubuntu Natty, right clicking breaks this.

I think we can stop worrying. Facebook has a detection mechanism for these false / forced likes :-) http://i.imgur.com/qf7VQ.png

Reply on news.ycombinator.com