"Like"ing on facebook can be false...

On facebook, lately I've seen several false pages making you like them. If you're unfamiliar with facebook (seriously?), then when you see something, you can click a Like "button". This Like shows anyone else that you like it. This may change according to your own privacy and account settings however.

‎"Like"ing a page without clicking like...
The current stuff going on _might_ have to do with a similar technique described on this page,
https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Information

It's just a guess so YMMV.

Abusing HTTP Status Codes to Expose Private Information | Mike Cardwell, Online
grepular.com

A technique for silently and automatically determining if a site visitor is currently logged into various unrelated third party websites

It's just speculation for now, but...
Imagine the technique above actually using this URL instead of
http://www.facebook.com/settings/?tab=privacy&ref=mb
then scraping the page looking for the link to customize... If you look closely at that link, it appears to be a has or random number of some sort that is most likely indicative of your current session, or trying to stop this type of attack perhaps.

This probably happens when you click the "play" button on the offending "video" site. And with that info, keep in mind click jacking http://en.wikipedia.org/wiki/Clickjacking ...

Taking it a bit further, what's stopping someone from writing a javscript based browser (http://www.codelifter.com/main/javascript/accentbrowser1.html) and include in that browser a malicious tool to go through all of your currently open sites / cookies / pvt info etc...

I've got no idea if it would work (suspicions say yes though) Just sayin...
The combination above is just too nasty to ponder any longer... So I guess I'll have to do or do not...


So in short? I install on my "harmless" website a transparent frame (click jacking) over top of my real website which in turns proxies all input devices through to the real page, while asynchronously installing a javascript browser in your current browsing session (could even change your homepage to download the JS browser maybe?), then checking all current URLs open, I proceed to find out if you have any open sessions to some sites site (my @sites=qw(facebook, myspace, twitter, site1, site2, siteX);foreach my X in @sites ... etc), if so go to them and start to gather information, and potentially open up a transparent frame in your new browser that's overlaid onto a valid site:X and asks for you to re-enter your address to continue to stay logged in.

just sayin...

Chris-