Ask HN: Facebook clickjacking – is it detectable?

Re:Ask HN: Facebook clickjacking – is it detectable? by socket0 on Monday September 14, 2015 @07:57AM (#10214652)

It's possible to detect whether an element is visible using window.getComputedStyle(). Why don't Facebook do this? Because it's slow. And measures like this can cause problems on the page. They want their button integration to be fast and low impact, so they would rather handle a couple of abusers (which they're quite good at) than inconvenience a large number of sites.

[ Parent | on HN ]

Re:Ask HN: Facebook clickjacking – is it detectable? by mattmanser on Monday September 14, 2015 @09:18AM (#10214882)

'Because it's slow' doesn't seem to make much sense to me. Couldn't they register the click then do the check, allowing them to have the best of both worlds?

[ Parent | on HN ]

Re:Ask HN: Facebook clickjacking – is it detectable? by socket0 on Monday September 14, 2015 @10:08AM (#10215106)

It's JavaScript, so the client pays for it. If you're on an already slow browsers, you don't want to see it choke after you click on a button. So companies like Facebook ignore the problem on the client side, and solve it on the server side.

[ Parent | on HN ]

Re:Ask HN: Facebook clickjacking – is it detectable? by MasterScrat on Monday September 14, 2015 @09:08AM (#10214843)

Couldn't an attacker override window.getComputedStyle() at runtime anyway?

[ Parent | on HN ]

Re:Ask HN: Facebook clickjacking – is it detectable? by socket0 on Monday September 14, 2015 @10:15AM (#10215140)

Presumably Facebook would have CSP headers set on some of the scripts they load to prevent JavaScript on the page from interacting with their own scripts.

[ Parent | on HN ]

Re:Ask HN: Facebook clickjacking – is it detectable? by malft on Tuesday September 15, 2015 @09:05AM (#10220382)

getComputedStyle() doesn't work across iframes.

[ Parent | on HN ]