Deceiving Users with the Facebook Like Button

Facebook just launched a super-easy widget called “The Facebook Like Button”. Website owners can add a simple iframe snippet to their html, enabling a nice “Like” button with a count of other people’s “Likes” and a list of faces of people if any of them are your friends. The advantage of this new tool is that you don’t need any fancy coding. Just fill up a simple wizard , and paste the embed code in, just like you do with Youtube, etc.

However, this simplicity has a cost: Users can be tricked into “Like”ing pages they’re not at.

For example, try pressing this “Like” button below:

This is what happened to my Facebook feed when I pressed it:

Screen shot 2010-04-21 at 10.45.01 PM

I used as an example here to be work/family-safe; you’re free to come up with examples of other sites you wouldn’t want on your Facebook profile! 🙂

Important note: Removing the feed item from your newsfeed does not remove your like — it stays in your profile. You have to click the button again to remove the “Like” relationship.

This works because the iframe lets me set up any URL I want. Due to the crossdomain browser security, the “Like Button” iframe really has no way to communicate with the website it’s a part of. Facebook “Connect” system solved this using a crossdomain proxy, which requires uploading a file, etc. The new button trades off this security for convenience.

An argument in Facebook’s favor is that no self-respecting webmaster would want to deceive the visitor! This is true, the motivation to deceive isn’t very strong, but if I am an enterprising spammer, I can set up content farms posing as humble websites and use those “Like” buttons to sell, say Teeth Whitening formulas to my visitor’s friends. Or, if I’m a warez / pirated movie site, I’m going to trick you with overlays, opacities and other spam tricks and sell your click on an “innocent” movie review page to a porn site, similar to what is done with Captchas. I’m going to call this new form of spam Newsfeed Spam.

This is scary because any victim to this is immediately going to become wary of using social networking buttons after the event; and will even stay away from a “Share on Twitter” button because “bad things have happened in the past with these newfangled things”!

I don’t have a good solution to this problem; this sort of spam would be hard to detect or enforce since Facebook doesn’t see the parent page.

• One weak solution is to use the iframe’s HTTP_REFERER to prohibit crossdomain Likes. I’m not sure how reliable this is; it depends on the browser’s security policies.

• Yet another solution is to provide the user with information about the target of the Like. e.g. it can be:

  • Shown in the initial text, i.e. “and 2,025 others like this” now becomes “and 2,025 others like “Britney Spears”…” The downside to this is that it can’t be shown in the compact form of the button.
  • Shown upon clicking, i.e. “You just liked”
  • (my favorite) Shown on mouseover the button expands to show the domain, “Click to Like….”

This problem is an interesting mix of privacy and usability; would love to see a good solution!

Unfortunately making things easier often means making them unsafe when it comes to web development