Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cursor:none abuse (trick users into clicking Facebook 'like')

jack-shepherd.co.uk

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#51

Post by driverdan »

cs702 wrote: post #23
ben0x539 wrote: post #10

Earlier quoted context omitted.

Given what we've been seeing with attack sites, whether shock sites trying to just DoS the browser or silly tricks like making the browser POST to an irc server's irc port to spread the malicious URL, or just terrible ads and tracking that actively slow down the browser and ruin the surfing experience, I'm amazed that not more people see javascript as a built-in remote code execution vulnerability that only gains mor…

By default I have JavaScript blocked on all sites, allowing it only as needed, case by case, because JavaScript is a remote-code-execution vulnerability of modern browsers. More and more of the applications we use and our private data live in the cloud. We now access our personal files, manage our bank and investment accounts, and make retail purchases on our web browser. Browsing the web with JavaScript enabled by d…

This shows a general lack of knowledge about how JS and websites work. I can't just run JS on my site that will steal your bank info. Browsers have cross domain security policies to prevent this.

There have been various vulnerabilities (especially in IE) but just like any other software they get fixed.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#52

Post by endtwist »

duopixel wrote: post #36

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/

Even better: http://jsfiddle.net/rVxTn/8/

pointer-events: none on an opaque container, with the FB 'like' button below it.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#53

Post by kzrdude »

joelhaasnoot wrote: post #15
Zirro wrote: post #11

It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.

What website is useable these days though without Javascript?

www.google.com is a good example.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#54

Post by moe »

Zirro wrote: post #17
joelhaasnoot wrote: post #15

Earlier quoted context omitted.

What website is useable these days though without Javascript?

Few of the popular ones, but there may be some misconception here. NoScript isn't meant to be blocking JavaScript for all sites. If you trust a site, which doesn't function without JavaScript, adding it to the whitelist is one click away. You get used to it quickly. And, even in the mode where JavaScript is allowed by default on new sites, the other protections (Clickjacking, XSS, ABE, etc) still apply.

It's a little bit like the cookie-situation back when the internets were still young.

Many people (including myself) would swear by leaving the cookie notification on and confirming every. single. one. of. them.

That has long stopped being feasible and I assume it will be the same with NoScript in a few years.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#55

Post by coderdude »

duopixel wrote: post #36

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/

Great job! I wouldn't mind using this for legitimate reasons. I use custom share buttons on one of my sites and I hate having to use a popup. It's a hack. But this is a sexy hack with better integration.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#56

Post by drucken »

I have NoScript 2.3.1 in Firefox with the default settings, including Clearclick protection. I have no Facebook account and no scripting is enabled for this site, including JQuery.

The site is still able to disable my mouse over most of the screen.

Am I the only one?

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#57

Post by thekevan »

duopixel wrote: post #36

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/

In Chrome 16 on Ubuntu Natty, right clicking breaks this.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#59

Post by burgerbrain »

duopixel wrote: post #36

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/

That more straightforward approach also avoids an unexpected downside of this approach. I never really noticed it before, but my mouse icon is black instead of the apparently usual white. My mouse suddenly turning white on that page makes it pretty clear what is going on.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#60

Post by timmy-turner »

moe wrote: post #54
Zirro wrote: post #17

Earlier quoted context omitted.

Few of the popular ones, but there may be some misconception here. NoScript isn't meant to be blocking JavaScript for all sites. If you trust a site, which doesn't function without JavaScript, adding it to the whitelist is one click away. You get used to it quickly. And, even in the mode where JavaScript is allowed by default on new sites, the other protections (Clickjacking, XSS, ABE, etc) still apply.

It's a little bit like the cookie-situation back when the internets were still young. Many people (including myself) would swear by leaving the cookie notification on and confirming every. single. one. of. them. That has long stopped being feasible and I assume it will be the same with NoScript in a few years.

Isn't this the fault of a bad UI mixed with bad defaults? I'm using the Cookieculler FF addon (https://addons.mozilla.org/en-US/firefox/addon/cookieculler/) to manage them. Instead of torturing me with a modal popup for every new site I visit, it keeps a list of hosts and cookies and trust status in the background. Using that list to protect important but delete/block all other cookies is quite convenient.
Post reply on HN