TakeThisLollipop - really clever/creepy use of the Facebook API

http://www.takethislollipop.com/

by wesleyzhao • 15 years ago

440 133 15 years ago

Oooh! Well played. I really want the candy, but I know they're going to do something bad with the information they take from me... I'm still tempted.

Ok, so I did it and now I'm never sleeping again.

Pfiffer• 15 years ago

Care to explain for those without Facebook accounts?

wesleyzhao3• 15 years ago

Indeed. So basically someone made a very high quality video of a creepy dude in a dark room creeping on Facebook and getting really mad. Then (with some special effects they used) they make it look like (almost perfectly) the guy is viewing your profile page, looking through your photos, and creeping on your friends. Then he maps your last known location on Google Maps, looks right at you, and drives over to your house.

It's eerily realistic.

Disclaimer: not my project, found it on the web.

ricefield3• 15 years ago

not to mention that, in the car, he has a print out of your profile picture, and a screwdriver (or is it a box cutter) in his hand as he exits the car.

splish• 15 years ago

" ... Just upload lots of pictures of cats, then it's LOL funny." -Jason Zada

morsch• 15 years ago

I guess this is a teaser trailer: http://www.youtube.com/watch?v=-xBA0mpWuuo

henrikschroder2• 15 years ago

It's an example of how much personal data you actually leak through Facebook illustrated through a movie of a crazy serial killer browsing Facebook, with nicely done overlays of your actual personal data that the app pulled from you.

ricefield3• 15 years ago

no, not really, considering you have to explicitly allow the app to access all that data...

Radim• 15 years ago

  movie of a crazy serial killer browsing Facebook

Serial killer? That's just your assumption, based on video editing. Remember the scene in Men in Black, where Will Smith is asked to shoot cardboard aliens and shoots a little girl instead?

HN Against Prejudice! :-)

(showed TakeThisLollipop to my gf, who freaked out and immediately deleted all fb apps... so prejudiced!)

patja• 15 years ago

Since when does "leak" equate to "explicitly grant permission to access"?

It is not like the app is getting information that some random hacker can access, at least if you have any privacy controls set on your Facebook profile.

zrgiu_2• 15 years ago

Can someone make a video of this thing ?

user24• 15 years ago

http://www.takethislollipop.com/assets/takethislollipopv4.mp...

hiraki9• 15 years ago

That was very, very well done.

How did they do video compositing on top of an embedded browser window in Flash?

Perhaps they pre-rendered the webpages server-side using WebKit or some such and sent a screenshot to Flash....

egiva• 15 years ago

Flash has the capability of incorporating dynamic content in flash-driven movies. See how to do it (easy example), here:

UPDATE: better link here: http://flashexplained.com/actionscript/loading-external-jpgs...

tomasienrbc• 15 years ago

This is a pretty disruptive use of the Facebook API. Personalized entertainment content, I love it!

Hitchhiker• 15 years ago

Brilliant.. could help people think more clearly. Another play on these issues, http://youropenbook.org

toast76• 15 years ago

This could be exactly what I need to finally get my wife off Facebook....

bteitelb• 15 years ago

The production value is very high. FB Open Graph Protocol meta tag found in source:

  <meta property="og:type" content="tv_show"/>

Perhaps it's a viral media stunt to promo a new TV show.

wesleyzhao3• 15 years ago

I'm not sure that it is, but now that you mention it I feel like this could actually be a REALLY effective viral media stunt for a new TV Show/Movie...

mikeburrelljr• 15 years ago

Amazingly well done... Now, I'm going to cry myself to sleep.

skeletonjelly• 15 years ago

In the same position. Had the new Walking Dead season playing on the TV in the background. Great, great combination.

Axsuul• 15 years ago

Doesn't work for me? Do I not have enough info?

sebastianhoitz• 15 years ago

There was something similar with "Notruf Deutschland": http://www.notruf-deutschland.com/teaser/

They had a similar "approach" :)

Still, very nicely done!

runn1ng2• 15 years ago

What exactly happens after the one hour on the end? Can't afford to wait right now

wesleyzhao3• 15 years ago

he knocks on your door

robinduckett2• 15 years ago

Yeah, good luck to him finding "X5, Cardiff".

There isn't an "X5" postcode here, nor is it anywhere near where I was last time I did a location based update. The inaccurate google map thing is what made me lul.

auston• 15 years ago

nothing, the clock simply runs out...

will report back tomorrow with a follow up comment ;)

snaveint• 15 years ago

That is impressively creepy. Wow. Anyone know the background?

davidw• 15 years ago

He is seriously pissed off that you are advocating the use of Emacs over vim in some Facebook group.

mahen232• 15 years ago

haha, good one.

hermannj314• 15 years ago

It killed the mood when he searched for ,(null) in Google Maps, but otherwise pretty freaky.

robinduckett2• 15 years ago

It's nice that you can disallow the permissions granularly, for example, I didn't mind it accessing all my data, but posting AS me on facebook? No. Disabled. Happy days.

polemic• 15 years ago

Keeps cutting out part way through, but VERY well done.

flexd2• 15 years ago

This actually just freezes for me/nothing happens after I click "Connect with Facebook". Chromium 12.0.742.112 (90304) Ubuntu 10.10.

ma2rten• 15 years ago

I had the same. I looked at it in chrome inspector and it turned out the reason was that I didn't allow the 2nd set of access rights, because it said it was optitional.

Fliko• 15 years ago

I didn't allow them and it still worked for me.

captn3m0• 15 years ago

Flashblock?

flexd2• 15 years ago

I use both Adblock Plus and Better Popup Blocker. But both disabled/site allowed. :-/

suivix• 15 years ago

Linux end-user issue #988823422

kikibobo69• 15 years ago

Same for me on Chrome + MacOS. I opened it in incognito mode and it worked.

steilpass2• 15 years ago

Revoked access to tons of applications.

ljf• 15 years ago

Likewise, found about 30 that I had allowed access to - no idea when I did half of them! All gone now!

steilpass2• 15 years ago

Same here. And when I was at it I looked at Twitter.

itsnotvalid• 15 years ago

If you don't want sites like this to view your stuff, please also set the privacy setting for applications your friends use to a better one. Or else you would be next.

P.S. Since you connect to that application by yourself, that is pretty clear that they can read your friends list, your feed and post as you.

rane• 15 years ago

I gave the guy all those details and pics while authorizing the app!

There's no way too see those things without being my friend.

georgemcbay• 15 years ago

There's at least one other way... make a creepy viral lollipop site, get it on the front page of hacker news, et al.

Wilya• 15 years ago

Well, how many other seemingly innocent (or not) apps did you give the same permissions to ?

powrtoch• 15 years ago

This. It's very well done and all, but what is the point? That if you explicitly allow access to one specific application, that application will have access? Or is the creepy guy supposed to be the app developer?

A better idea (maybe not possible, I dunno) might have been to have different things happen based on your privacy settings. That would actually call people's attention to something they should care about, instead of just fear-mongering to everyone regardless.

darklajid2• 15 years ago

If you care about your privacy settings and lock them down. you are (probably) not the target audience. And part of a minority anyway.

Speaking of which, how many of your FB friends would grant ~impersonation~ rights to an app without lots of thoughts? And - could that app then, using your _friend_ as proxy, play this particular game of fear with you?

slapshot• 15 years ago

Looks like it's connected with the ad agency Evolution Bureau ("EVB") (clients: [1]), the same people who did the Office Depot-braded "Elf Yourself" sensation [2].

Why do I think it's EVB? This is the only other site on the same IP as manipulation.com, and manipulation.com is registered clearly to EVB. The agency's creative work is consistent with this project too.

[1] http://evb.com/work/ [2] http://elf.evb-archive.com/

andrewcooke• 15 years ago

any idea who the client is? i searched for "evb google" but didn't come up with anything...

jdp23• 15 years ago

On Twitter, EVB's CEO said they didn't do the site.

http://twitter.com/#!/danielstein/status/126322020152651776

caryme2• 15 years ago

It's at least the same director as Elf Yourself, according to the actor in it (https://twitter.com/#!/billoberstjr/status/12611132567074816...).

missing_cipher• 15 years ago

Same guy from http://www.youtube.com/watch?v=lAihDAJX8Ow ?

EDIT: Yup: http://www.fearnet.com/news/b23933_mastodon_premiere_twisted...

mikeryan• 15 years ago

It's not Evolution Bureau.

It was Jason Zada (http://jasonzada.com/) a Commercial and Music Video director who may have one point been at EVB (and was the one who registered manipulation.com) but apparently he's now at Tool of North America.

http://bits.blogs.nytimes.com/2011/10/18/mysterious-site-cre...

technogeek00• 15 years ago

Quality is fantastic, I too am curious as to how they are generating the pages into the movie.

paul9290• 15 years ago

Here's a similar thing from summer 2010. You and your friends inserted into a horror movie trailer.

http://www2.lost-in-val-sinestra.com

gurraman• 15 years ago

A little video that gives you the feeling of this, without the personalization:

http://www.youtube.com/watch?v=-xBA0mpWuuo

ben_hall• 15 years ago

What happens when the countdown gets to zero?

neoveller• 15 years ago

I tested this out for you. It just stops at 00:00:00 and nothing happens at all!

mahen232• 15 years ago

Good luck finding me in the middle of the Indian Ocean dork

0x126• 15 years ago

Funny, my hosts file seems to interrupt the flow of this prank slightly.

We'll see how my s.o. reacts to it, but on my machine it does absolutely nothing.

In case you're wondering what is in my hosts file:

  127.0.0.1 www.facebook.com
  127.0.0.1 facebook.com
  127.0.0.1 connect.facebook.net
  127.0.0.1 facebook.net
  127.0.0.1 fbcdn.net
  127.0.0.1 www.fbcdn.net
  0.0.0.0 badge.facebook.com
  0.0.0.0 blog.facebook.com
  0.0.0.0 en-gb.facebook.com
  0.0.0.0 developers.facebook.com
  0.0.0.0 touch.facebook.com
  0.0.0.0 de-de.facebook.com
  0.0.0.0 stories.facebook.com
  0.0.0.0 it-it.facebook.com
  0.0.0.0 hu-hu.facebook.com
  0.0.0.0 peace.facebook.com
  0.0.0.0 et-ee.facebook.com
  0.0.0.0 az-az.facebook.com
  0.0.0.0 0.facebook.com
  0.0.0.0 apps.facebook.com

A nice side-effect of this seems to be that the web has become a lot more responsive. No more 'like' buttons popping up all over the place.

edit: regarding my s.o. it's been an interesting morning, this app seems to have opened her eyes to facebook in a different way. No more apps.

JonnieCache• 15 years ago

You can achieve a similar thing with the ghostery extension.

http://www.ghostery.com/

kgosser• 15 years ago

Wow cool thanks for the link. Just installed it.

NanoWar• 15 years ago

Ah that's why I see nothing. Nice!

NapoleonB2• 15 years ago

thanks, also didnt know about this one - was using 'abine' which is similar. I like the ghost icon though :-)

RyanKearney• 15 years ago

Actually no one really cares what your host file looks like.

chunkyslink• 15 years ago

I'm quite interested. Mostly because I use similar Facebook blocking techniques so its nice to know what others do too.

0x126• 15 years ago

One of the problems with speaking for everybody on a forum with 10's of thousands of active users is that invariably you don't.

ltamake2• 15 years ago

Your opinion does not equate to everyone's opinion. I'm quite interested in his hosts file (because of blocking like buttons).

ottbot• 15 years ago

Is it actually funny or surprising to you, given your hosts configuration, or did you just want to mention it?

0x126• 15 years ago

Surprising, because I'd totally forgotten about it and really wanted to see what this was all about (after reading some of the comments here).

So I thought to myself 'ok, this once' knowing I'd be sticking my head out. It took me a minute or two to realize the cause and I thought that was a nice side-effect of solving this at the DNS layer, even when you're momentarily stupid this will still create enough of a barrier that you'll stop to think a bit longer.

I didn't know about the ghostery extension, so thanks to the person that posted that, that's another good solution.

FB has had its use for me (it found a bunch of long lost people), I haven't been back since.

eli• 15 years ago

You're better off using a browser extension or other technique.

Facebook uses a lot of subdomains like static.ak.fbcdn.net and there's no way you can include them all in your list.

0x126• 15 years ago

Good point. I'm pretty old school so the hosts file was my first line of defense. I didn't know about ghostery until this thread so that's installed now as well.

dfc• 15 years ago

Just point your dns cache to an instance of tinydns that is configured to be authoritative for fb's domains.

jisaacstone• 15 years ago

on Opera it just shows a 'like' button. Any ideas on that?

veyron• 15 years ago

There was another discussion on this point, where a few others were added:

0.0.0.0 static.ak.fbcdn.net 0.0.0.0 www.static.ak.fbcdn.net 0.0.0.0 login.facebook.com 0.0.0.0 www.login.facebook.com 0.0.0.0 fbcdn.com 0.0.0.0 www.fbcdn.com 0.0.0.0 static.ak.connect.facebook.com 0.0.0.0 www.static.ak.connect.facebook.com

driverdan• 15 years ago

Why would anyone authorize Facebook access for a random site like this? No privacy policy, no about page, no terms. You have no idea what they're actually doing with your data.

yangyang• 15 years ago

Maybe that's the point of it - most people won't think twice about authorizing, but might realise what they've opted into once they see it.

pabloPXL• 15 years ago

create a fake one-time account? :)

mrgoldenbrown2• 15 years ago

Sorry, but seeing a privacy policy and about page is not a valid way to judge if an app is malicious or not.

VonLipwig• 15 years ago

That was amazing. You know its a joke.. but the production value is so high your can't help but be really creeped out by it. I have removed every app which I have signed up to from accessing my Facebook account. I have also bolted my front door.

shivers

ltamake2• 15 years ago

I know, it's effing creepy.

I wasn't planning on sleeping tonight anyway!

SecretofMana• 15 years ago

For me, this was rendered hilarious by some of the images people have tagged me in on Facebook that don't actually have me in them. Seeing the serial killer erotically stroke a picture of a T-Pain coffee mug is rather amusing.

That being said, is there any way I can be sure besides the disclaimer that this isn't actually saving/using my personal data outside of the video? I guess that's part of the point, that I really can't, though.

cubix• 15 years ago

I saw a Second City improve last winter, and one of the better sketches exploited Facebook similarly, albeit in a more lighthearted and humorous way.

Prior to the performance they would find an audience member's Facebook page using their credit card or mailing address (presumably), and write a sketch based on the details extracted from his or her page.

They incorporated the lucky patron's inevitable reaction into the sketch under the pretense of reprimanding him for disrupting the show. After letting him squirm a bit under the spotlight, the punchline was projecting his Facebook page on the screen across the stage.

strickjb9• 15 years ago

This is a genius idea. I'm sure it will go viral and everyone (including their mother) will give this site a test drive.

I can only assume that it is designed to do one thing - data mine.

dolphenstein• 15 years ago

It has the power to post on your wall as well.

Removed the app before they pull that one....

stef25• 15 years ago

I wonder if it would be possible to for the app to send you an sms (or even call you!) with some creepy "I'm outside, baby" message at the end of the movie.

Peroni3• 15 years ago

Very clever but I imagine it would be cost prohibiting given the amount of people that will try the app out.

cpeterso• 15 years ago

The call is coming from inside the house!

omid• 15 years ago

My 64bit flash player 11 on Linux crashes right away!

Cushman• 15 years ago

Mobile Safari: "You need at least Flash Player 10 to view this page."

Apple saves the day again!

klausjensen• 15 years ago

Would seem like the viral success has overloaded the site... I can't get it to play any longer, and it worked an hour ago.

jmilloy• 15 years ago

I don't think I get it... when I let a facebook app access my facebook, it can... access my facebook and look at my pictures? anyone can look at my pictures, anyways. i'm missing something here

darklajid2• 15 years ago

I seriously hope you're not serious.

1) Of course, you _can_ allow everyone to see your pictures. That's not necessary though and one of the (many) privacy concerns this site seems to focus on. If you share your pictures, you share a HUGE amount of data. Ignore the passed out/joking stuff, you might tell me a lot about your place (expensive stuff in the background? pictures that show a street name?) and your habits (always going to his parents on weekends. currently on vacation). This is, in theory, very easily exploitable, for someone with a criminal mind and the balls to pull of a stunt.

2) Regarding Facebook apps: Well, don't allow those to access your data? You saw what this app did (and automatically, without a human involved). It can exploit the date your coughing up every day in ways that you probably didn't think about before.

Bottom line: If you're the 'share with everything and play any FB game' type this might not shock you, but others might wake up and stop being very careless with their own private data.

pessimizer2• 15 years ago

I think it's that you're giving them access based on a picture of a lollipop, while having absolutely no idea who you're giving that access to. Never take candy from strangers.

lukejduncan• 15 years ago

I don't have facebook. Anyone mind writing a tldr?

Peroni3• 15 years ago

It's a facebook app. It asks your permission to access pretty much everything on your profile and when you finally accept it cuts to a fullscreen, high production video of an incredibly creepy actor on a computer in a really dingy room. It then cuts to the computer screen and shows the creepy guy scrolling through your profile page in a very realistic manner as well as clicking through some of your photo's and friends. The guy looks more and more irritated and angry and he goes and looks up your location on google maps (with mixed results, mine was relatively close).

It then cuts to him driving with a picture of your profile pic stuck to his dashboard, the whole time you get the feeling this guy is tracking you down with the intention of hurting you.

Really creepy and incredibly well done and surprisingly not obvious in terms of what they are promoting.

mvzink• 15 years ago

What are they promoting?

jtheory• 15 years ago

It's extremely creepy -- I watched a video on YouTube rather than sharing my own data, but I can imagine it.

They should consider adding a "trigger" warning, though, so rape survivors and so on can realize they're signing up for something that may be extremely upsetting and has nothing to do with lollipops.

Dunno if they thought about it and don't want to ruin the surprise for people who'll have more expected responses; but it's unfortunately one of those things that's going to be passed around with no more description than "hey check this out it's very educational".

andor• 15 years ago

Here's a video of what happens after you log in:

http://www.youtube.com/watch?v=-_GhKkXQrqo

coverband• 15 years ago

Thanks for the YT link since the site is down and I was curious. It seems to be very professionally done, I'm quite impressed.

NapoleonB2• 15 years ago

thanks. no-way i was going to allow some random site access to facebook ... video/insertion is pretty well done indeed! :-)

chippy• 15 years ago

crashes flash

caryme2• 15 years ago

It looks like this was made by Jason Zada (https://twitter.com/#!/jasonzada) according to a tweet by the actor (https://twitter.com/#!/billoberstjr/status/12614080094496358...).

mindstab• 15 years ago

One interesting thing about how this was designed, it for some reason doesn't get your location from your facebook profile. It uses your IP address, which led to hilarious results because while my facebook rightly says where I am, I was using a SOCKS proxy to access this in a different city and when it showed him looking at a map it showed the route to my SOCKS proxy instead of me. I guess I'm safe and the crazy guy won't kill me :)

freedompeace• 15 years ago

I don't think the Facebook API allows you to find your location (although it is possible to retrieve your Facebook location by scraping the Security page for your current login session (which displays your location)).

Also, the location data that is displayed on that page is kind of inaccurate (it says I'm in another state).

arnorhs• 15 years ago

Not by IP, FWIW. I'm in Mountain View but the guy seemed to want to find me in Reykjavik, Iceland, where I'm from. (I moved to the Bay Area a month ago, but haven't update my FB)

rufibarbatus2• 15 years ago

This guy over here [1] claims the video tracked his last foursquare check-in. I'm guessing the location algorithm tries to find a best guess of where you might be — hence the inconsistent results.

[1] http://www.jenders.com/2011/10/18/take-this-lollipop-and-the...

codezero• 15 years ago

My guess is that this is an advertisement for LCD monitors... the guy went crazy because he's still using a CRT... poor fella.

alanh• 15 years ago

Hilarious that the content & domain name could lend this to being classified, in some filters, as a “shock site” ;)

lzell• 15 years ago

Google street view would have been a nice addition too, depending on the accuracy of the geo lookup.

oscardelben• 15 years ago

Geoffrey Grosenbach is next. Oops

TakeThisLollipop - really clever/creepy use of the Facebook API

Related Stories