3 ms·
Iframes will never go away. But we need a way to tell a browser "if you embed this page into an iframe, it needs to be the topmost content, no transform/transl
by unilynx 8y ago
Iframes will never go away.
But we need a way to tell a browser "if you embed this page into an iframe, it needs to be the topmost content, no transform/translate/visibility or anything". Social/login iframe would set that flag, and it would prevent the clickjacks and attacks like this.
- deleted 8y ago[deleted]
- user5994461 8y agoAll websites are supposed to set the header X-Frame-Options: DENY to block iframes. It's a solved problem.
- empyrical 8y agoThat doesn't solve the issue of clickjacking attempts on pages meant to be in iframes (FB like buttons are in iframes)
- unilynx 8y agoThat solves clickjacking for things which don't want to be iframed, but not for things like the Like button or login buttons which specifically need to be embedded into an existing page (and they were the attack vector for this article)