CSS-Only Clickjacking

Re:CSS-Only Clickjacking by pacmon on Tuesday May 15, 2012 @09:54PM (#3979971)

@taze There is a way. It's called noscript. Does a terrific job of staying on top of issues like this.

Also because of this example I went one step further and used AdBlock to block any iframe with a facebook url.

@general The facebook button (at least in firefox) doesn't change to the hand icon when hovering over the link. So, fail. I wouldn't click a link where the cursor didn't change. Mostly, because when it doesn't change I immediately become suspicious.

[ Parent | on HN ]

Re:CSS-Only Clickjacking by darklajid on Wednesday May 16, 2012 @07:47AM (#3981603)

As someone who's lazy with AdBlock (subscribe, forget): Can you share that rule?

[ Parent | on HN ]

Re:CSS-Only Clickjacking by pacmon on Friday May 25, 2012 @08:54PM (#4026023)

Hey. Sorry for a majorly delayed response. Looks like I have two rules for this. They might be able to be optimized into one, but - I'm lazy too.

  com##IFRAME[src^="http://www.facebook.com/]

  ##IFRAME[src*="facebook.com"]

edit: Note - you need the 'Element Hiding Helper' that goes with Adblock Plus to do this. Then you can just use that to select the iframe on a site and add the rule through a nicer interface.

[ Parent | on HN ]

Re:CSS-Only Clickjacking by TazeTSchnitzel on Wednesday May 16, 2012 @11:33AM (#3982411)

I meant what Facebook could do, not you personally.

[ Parent | on HN ]