That's not a problem at all. If it's worth it to do it, people will do it even if it takes 200 lines. If it's not, they won't bother. So, even with it being achievable as a "first-class" option in CSS4, I don't see any particular rise of this exploit happening.
It's like arguing that something is safer because it requires 10 lines of code instead of one to do the exploit. That's security by obscurity.
Comments
You don't need CSS4 to clickjack, just put the Facebook Like button on top of the link and apply opacity: 0.
http://jsfiddle.net/txbYs/
The problem is that this new directive makes this exploit first-class citizen.
That's not a problem at all. If it's worth it to do it, people will do it even if it takes 200 lines. If it's not, they won't bother. So, even with it being achievable as a "first-class" option in CSS4, I don't see any particular rise of this exploit happening.
It's like arguing that something is safer because it requires 10 lines of code instead of one to do the exploit. That's security by obscurity.
I guess you're right. Maybe the effect is reverse even - by raising attention to potentional pitfalls.
Still, I can not think of a possible use case this can be useful. Maybe other options will make it worth knowing about.