Fraudulent Advertising on Facebook
medium.com
Fraudulent Advertising on Facebook
1–10 of 100 posts
Re: Fraudulent Advertising on Facebook
#2Why is there even a separate field for "Display Link", is there a reason this can't be parsed from the actual URL (like HN)?
Re: Fraudulent Advertising on Facebook
#3Pretty egregious. I hope facebook wakes up to this type of fraud quickly because it is the kind of stuff my relatives fall for all the time.
Re: Fraudulent Advertising on Facebook
#4Considering that Facebook lets you set the display domain separately from the actual link domain, this behavior seems entirely intentional. Convincing people to click on ads (by lying wholesale, in this case) is a crucial element of Facebook's business model.
This does seem like they're trading long-term trust for short-term profits - users will click on fewer and fewer sponsored posts as the number of deceitful posts like this increase.
Re: Fraudulent Advertising on Facebook
#5Why is there even a separate field for "Display Link", is there a reason this can't be parsed from the actual URL (like HN)?
Because the actual URL is often some metrics or ad-billing service which is supposed to redirect to the target. This is quite common on Google as well as on Facebook.
Re: Fraudulent Advertising on Facebook
#6Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given:
if (display_domain == landing_page_domain) { approve_ad = true; }else{ approve_ad = false; }
is, for one thing, not robust against cloaking (if malicious advertisers see the request coming from a Facebook IP, they might actually redirect to the displayed domain).
Re: Fraudulent Advertising on Facebook
#7Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given: if (display_domain == landing_page_domain) { approve_ad = true; }else{ approve_ad = false; } is, for one thing, not robust against cloaking (if malicious advertisers see the request coming from a Facebook IP, they might actually redirect to the displayed domain).
He clearly states that security is about raising the bar as high as you can. You can't build a bulletproof system, but you can make systems that are not trivial to game.
Re: Fraudulent Advertising on Facebook
#8Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given: if (display_domain == landing_page_domain) { approve_ad = true; }else{ approve_ad = false; } is, for one thing, not robust against cloaking (if malicious advertisers see the request coming from a Facebook IP, they might actually redirect to the displayed domain).
He clearly states that security is about raising the bar as high as you can. You can't build a bulletproof system, but you can make systems that are not trivial to game.
Redirecting based on client IP is trivial for anyone with sufficient resources to have put together that ESPN clone in the first place.
Re: Fraudulent Advertising on Facebook
#9Why is there even a separate field for "Display Link", is there a reason this can't be parsed from the actual URL (like HN)?
Because the actual URL is often some metrics or ad-billing service which is supposed to redirect to the target. This is quite common on Google as well as on Facebook.
While this is a good answer to the people saying "clearly facebook is trying to abet fraud by making these fields independent of each other", there is no technical reason why you couldn't parse the target URL from the actual one -- it's easy to hit the actual URL and parse the redirect you receive.
That opens you up to a URL which redirects you somewhere trustworthy when you check it but redirects later ad-clickers somewhere shady when they check it; mitigating that is harder but approachable.
Re: Fraudulent Advertising on Facebook
#10Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given: if (display_domain == landing_page_domain) { approve_ad = true; }else{ approve_ad = false; } is, for one thing, not robust against cloaking (if malicious advertisers see the request coming from a Facebook IP, they might actually redirect to the displayed domain).
Facebook could probably check periodically from a separate IP (secret-shopping, if you will) and pull the URLs that don't comply.
Of course, it'd probably turn into an arms race as malicious advertisers try to profile FB's bot behavior and properly redirect it.
That is to say, I agree with you, the problem is non-trivial.