Even without this trick it's trivial to clickjack a like button - just place the button on a div with an alpha transparency of 0.01 and trick the user in to clicking it.
Unfortunately it simply isn't possible to provide something like the Like button without being vulnerable to click jacking. I assume Facebook decided that the benefits outweighed the drawbacks. There's probably something clever they can do on the server side to statistically detect and penalize likely clickjacking attempts.
They do, eventually (unsure of the criteria) it will start showing a second confirmation dialog if they detect something untoward which you have to confirm your like with, although click jacking that too might also be possible.
Comments
Even without this trick it's trivial to clickjack a like button - just place the button on a div with an alpha transparency of 0.01 and trick the user in to clicking it.
Unfortunately it simply isn't possible to provide something like the Like button without being vulnerable to click jacking. I assume Facebook decided that the benefits outweighed the drawbacks. There's probably something clever they can do on the server side to statistically detect and penalize likely clickjacking attempts.
They do, eventually (unsure of the criteria) it will start showing a second confirmation dialog if they detect something untoward which you have to confirm your like with, although click jacking that too might also be possible.