41–50 of 69 posts
A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/
Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&...
Could definitely still be a problem for other social/ad/affiliate networks though.
It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.
What website is useable these days though without Javascript?
Odd effect. I see two mouse cursors (Mac OS X 10.7.3 + Chrome Dev Channel).
A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/
Wow - that is quite amazing. I wonder if that's in use in the wild yet. Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&... Could definitely still be a problem for other social/ad/affiliate networks though.
This makes attacks such as these a little less worrying.
A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/
Wow - that is quite amazing. I wonder if that's in use in the wild yet. Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&... Could definitely still be a problem for other social/ad/affiliate networks though.
Most people will click just to see what it might be and not miss out. Then the video player says you have to click on some letters to prove you're not a robot (clever trick, people don't think much of it because it reminds them of CAPTCHAs)
The letters actually have Facebook Like button iframes on them with opacity set to 0. I edited the opacity on one of them with the Chrome Dev tools:
http://polyprograms.free.fr/tmp/FacebookLikeClickJacking.jpg
Unknowningly liking the video will create a story in your friends' feeds, who will in turn click to see and spread it to their friends. No real harm is done except for the spam and all the ad views generated.
A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/
Wow - that is quite amazing. I wonder if that's in use in the wild yet. Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&... Could definitely still be a problem for other social/ad/affiliate networks though.
Earlier quoted context omitted.
Do you have any examples of sites/companies that put the techniques into use as a direct result of Evercookie exposing them? EDIT: Why am I being downvoted for this question? I am seriously interested, so that I can avoid contact with them.
I'm not sure if you can say that it's a direct result of Evercookie, but a number of high profile sites use this kind of tech - for example KissMetrics.com is used by a number of big companies, and they use ETAG cookies, Flash cookies - the lot.
It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.
What website is useable these days though without Javascript?
