Hacker News Reader

Comment by infosecau | Hacker News Reader

Just letting everyone know, by clicking anywhere on their page, you've now liked their Facebook page.

This was done via ClickJacking and here are the offending scripts/html:

You can unlike their page here: https://www.facebook.com/randomdirectionsblog

View on HN

Is this even legal? Isn't a like supposed to be performed by a human (and owner of the liking account)?

What's "legal" is determined by Federal, state, and local code. I can't imagine there are any laws against this kind of thing.

It almost certainly violates Facebook's ToS though.

Meta: what is HN policy on flagging? Is this a reason to?

Thanks. This is one of the reasons I always read the comments before the article on HN.

Wow, extremely scummy. I'm surprised more people aren't angry about this.

Because not everybody uses FB (I don't), or when they do, use a private/incognito window, "sandbox" the session, to avoid being tracked (that is how I use GMail).

I can't be the only one that does this, it takes almost no effort, and using a private window for the really "important" accounts, so you're not logged into them all the time, prevents a whole lot of problems and exploits.

Agreed Important to note that by default even in incognito window all sessions in that window (at least in chrome) are persisted. For example closing and opening tabs will resume last session) so this exploit may still work if you have Facebook open in the same incognito browser I've used plugins that further guaranteed a new session between tabs in incognito

Shouldn't this set off some alert at Facebook since their likes per visitor rate will be much higher than normal?

That style makes his whole introduction about this not being click-bait to advertise his business look really scummy.

Yup, look at graph of likes spiking in last couple of days: https://www.facebook.com/randomdirectionsblog/likes

The post on the blog itself is a month old.

That is true if you [1] have a Facebook account, [2] are logged in, and [3] have JavaScript enabled. None of which are true for me, but I wonder for how much of the Web-using population it is.

I would guess the majority of Facebook's userbase. Most people don't globally disable JS (I don't -- this would have gotten me).

I run noscript, but enabled their JS to view the charts. Luckily I never clicked on the page after that.

Reply on news.ycombinator.com