> Facebook users are generally careful about what they broadcast.

Seriously? Maybe among your tech-savvy friends, but the majority of Facebook users have no idea what they're doing when they type something into the box and click "Share."

A few minutes over at http://failbook.com/ is enough to point that out, and those are just the egregiously bad / hilarious cases.

I see this story come up a lot, but according to reCAPTCHA, it's an urban legend. There is not really any evidence that spammers actually do this at all, let alone do it on a meaningful scale.

Unless my memory is playing tricks on me, I recall Luis Von Ahn mentioning this as an example of ways people had attempted to defeat his system at a talk of his several years ago. He may have been talking about theoretical attacks and not actual ones, but I'm on my phone now and can't effectively dig for a video if one exists.

"Facebook users are generally careful about what they broadcast."

there are already lots of spam websites and fb apps, that trick into being a fan... i mean, "like" pages using js. this iframe only makes it easier.

i can even imagine spam js links altering a legit iframe, hoping a user clicks it afterwards.