Hacker News Reader

Comment by NathanKP | Hacker News Reader

The only possible protection that I can think of would be for Facebook to require confirmation when someone likes a page. Essentially it would redirect the user to Facebook where they would see a page that says "Are you sure you want to like ______?" Then, after they agreed, it would redirect them back to the original site. However, this would be highly undesirable for people who use the Facebook like button, because it could siphon away potentially valuable visitors who appreciated the site enough to like it.

Another option might be for Facebook to ban likes on a domain basis. If a domain is using spammy techniques like this then ban it from being liked by anyone. Of course that means more overhead and moderation.

I don't think there is a good solution to this, only work arounds.

View on HN

Facebook already does ban on a domain basis, but of course that's not a fix at all. These things are "viral" by the nature of the Like button since it posts on the user's wall automatically, so it's very easy for the "spammer" to make a new domain and get going again very quickly.

The easiest fix to the spreading of this issue is FB not broadcasting every single time you like something... but they're not gonna do that, we already know. So, the spam will continue.

What about forcing embedding sites to load a FB JS file, such that a standard Facebook confirm dialog pops up? This way the user doesn't navigate away from the site but some level of confirmation is made.

If the dialog pops up and is not within an <iframe>, then the page can simulate a click on the confirm button. Even if the JS library uses an <iframe>, it can always be reverse engineered to not use one, and the user won't know because iframes are not obvious to the user. The way above, where a new page is opened with the Facebook URL clearly displayed in the browser address bar, is the only way for Facebook to ensure that likes are legit short of putting CAPTCHA's next to the like buttons. Oh, and users never check the address bar anyway.

I don't see how reverse engineering to not use an iframe would help. Presumably Facebook would have some type of check on the iframed like page that ensures that the request is actually coming from FB. How would an attacker recreate an iframed page they don't have access to?

Subdomains and DNS mods with a proxy?

It'd be trivial to modify js behavior before the FB JS file loads.

For example...

window.confirm = function(m) { return true; }

Perhaps a batch confirmation once a week on facebook; "likes" don't become active until you look through a list of likes from the last seven days and ok them? Most of that sort of thing isn't very time-sensitive.

Here's one: stop using facebook.

Reply on news.ycombinator.com