<story><title>CSS-Only Clickjacking</title><url>http://jsfiddle.net/gcollazo/UMyEm/embedded/result/</url><text></text></story><parent_chain></parent_chain><comment><author>simonw</author><text>&quot;This seems like a real security threat and I haven&apos;t found a foolproof way of detecting it. Is there a way of protecting against this kind of attack?&quot;&lt;p&gt;No. If you&apos;re going to provide clickable widgets that can be embedded in other people&apos;s sites, there is no technical method for preventing clickjacking.&lt;p&gt;Even if it was impossible to hide the element (pointer-events: none is one method, another is to place the Like button itself on a div with an opacity of 0.001) it could still be attacked by tricking people to click repeatedly in a certain area and then displaying the button. &quot;Click here five times as fast as you can to win a prize&quot; kind of thing.&lt;p&gt;The developers of the Facebook Like / Twitter Follow buttons know this, but they decided that the trade-off was worth the risk. There are also statistical counter-measures they can take behind the scenes (machine learning algorithms for identifying large numbers of potentially fraudulent Likes for example).</text></comment>
<story><title>CSS-Only Clickjacking</title><url>http://jsfiddle.net/gcollazo/UMyEm/embedded/result/</url><text></text></story><parent_chain></parent_chain><comment><author>franciscoapinto</author><text>This again?&lt;p&gt;Ah. Good old noscript.&lt;p&gt;&lt;a href=&quot;http://i.imgur.com/Cb17T.png&quot; rel=&quot;nofollow&quot;&gt;http://i.imgur.com/Cb17T.png&lt;/a&gt;</text></comment>