milindl / facebook-link-fix

0 stars 0 forks source link

Don't use this plugin! #1

Open adarshaj opened 6 years ago

adarshaj commented 6 years ago

The reason for l.facebook.com preceding all links is two fold:

Both of these is core to security of users, by changing the links, you are essentially disabling the security layer added by facebook!

Here's more on how this can be exploited: https://blog.whatever.io/2015/03/07/on-the-security-implications-of-window-opener-location-replace/ (there's more vulnerabilities than what's explained in that article, you can probably dig deeper on the net to find them)

milindl commented 6 years ago

Thanks a lot for this, I thought they just used it for analytics for targeted ads!

Maybe it's much more useful to insert rel=noreferrer to certain sort of links instead, as the article suggests at the end.