

Socially engineering the Twitter follow button. - gcr
http://dl.dropbox.com/u/219506/twitter-spoof.htm

======
gcr
The new follow button provides no confirmation when you decide to "follow"
somebody and it provides no way of undoing your choice. I made this simple
demonstration in five minutes of a button that follows your cursor around the
page hidden with opacity.

If you followed the instruction and clicked on the page, you should see that
you're now following @justinbieber.

Imagine a scammer teleporting the follow button on top of links in onmouseover
in a similar manner.

~~~
rakkhi
Ha! nice work. Hope twiter fixes quickly.

~~~
gcr
It looks like twitter "fixed" it. Now no follow buttons work instantly for me,
they just take me to the twitterer's profile page.

Perhaps this is account-based? The button demo on twitter's webpage doesn't
instantly apply anymore either. I swear it did this morning.

~~~
jemka
Still works for me. I signed in twitter on chrome incognito window to verify.

