6 ms·

Google hits undo on limiting JavaScript capabilities in cross-origin iframes

100 points by kiyanwang 5y ago

ndkwj 5y ago
When they say they need to remove alert completely because it blocks the main thread you can see how disconnected from reality they are.
- gregoriol 5y ago
  This is indeed a very strange argument against alerts.
- GordonS 5y ago
  That is... a rather odd argument. As a user, why would I care if the main thread is blocked while a modal alert is displayed? If anything, that's probably the expected behaviour! An argument I could understand would be that `alert` etc look like system prompts, rather than something from the browser - but that's a browser concern that Chrome, Firefox, Edge, Safari etc could easily solve if they wanted.
vasachi 5y ago
This is what you get, when google has monopoly on the web platform. They will drop support for standards, because they want to and they can. And we won’t have any say in their decisions. I mean, the gall they have to shove their burden onto us, the developers. Google is a trillion dollar company. If they think, that alerts are confusing, they have all the money in the world to make them not confusing. But, I guess, dropping support is what google usually does.
- encryptluks2 5y ago
  This isn't about support, it is a sane security decision. Imagine finding that a door to your large shared office space is missing and people were coming in and stealing things. So you install a new door and suddenly people start saying... How dare you put a door there that people were using to steal things. The gall you must have to shove this burden onto us.
  - vasachi 5y ago
    Here’s the thing. It is not our problem that google doesn't want to make alerts less confusing. They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. How are they a security problem?
    - encryptluks2 5y ago
      This is about CSRF. Ever heard the phrase blinded by hate or blind hatred?
      - minitech 5y ago
        How are alert and CSRF related at all?
        encryptluks2 5y ago
        Because this is specifically in regarding to calling them from an iframe.
    - jeffchien 5y ago
      > They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. Can you cite this? Or is this just wild speculation?
      - vasachi 5y ago
        The Register cites this: https://github.com/whatwg/html/issues/6897#issuecomment-885773622 https://github.com/whatwg/html/issues/6897#issuecomment-8857... Also this: https://twitter.com/Rich_Harris/status/1422930436850860033 https://twitter.com/Rich_Harris/status/1422930436850860033
        jeffchien 5y ago
        Thank you!
- lucideer 5y ago
  > drop support for standards alert was never a W3C standard. It was a non-standard browser feature that happened to be widely implemented in the early days of the web. It was never part of any planned/agreed addition of well-thought-out features to the web. The only time it has been "standardized" is when the WHATWG recently decided it would be a good idea to describe the behaviour of all the legacy non-standard browser APIs that have been lying around in browser implementations since the early days of Javascript's existence. The WHATWG have strictly described this behaviour for alert within the "User Prompts" section of the HTML specification: a new section to describe an ancient function.
  - 0x0nyandesu 5y ago
    It being part of every browser makes it a defacto standard.
    - lucideer 5y ago
      If it were only a defacto standard I'd say they'd be even more justified in deprecation. It is now an actual standard though; I was just pointing out the history and reasoning behind its addition to the current standard. Given its WHATWG policy to define and codify the behaviour of every feature ever added broadly, if we believe no standard should ever be deprecated we'll never be able to deprecate anything at all and be stuck with every bad decision ever made.
    - UncleMeat 5y ago
      Are you equally mad about moves to eliminate cross-origin cookies? That was part of every browser.
  - BulgarianIdiot 5y ago
    W3C doesn't matter much, WHATWG is the spec we follow, W3C just chases after them. So don't equate "standards" with "W3C standards".
    - SahAssar 5y ago
- roenxi 5y ago
  > This is what you get, when google has monopoly on the web platform. This isn't even an obviously bad idea. It is bad for web developers, but I don't think it is easy to argue that web developers are the most important demographic for Google to cater to. If this is the sort of terror that monopolies are meant to be inflicting then the concept is barely important enough to get a mention. I don't like Google, and I remember the IE6 days. When Chrome is even a little comparable to what MS used to manage then maybe people should start complaining. This is nothing.
  - vasachi 5y ago
    What? Why should we tolerate bad behavior? Only because it’s less bad than Microsoft’s? That is not a very high bar, you know.
    - roenxi 5y ago
      We shouldn't tolerate bad behaviour. But you'll have to make an argument that it is bad behaviour. Google thinks this is a good idea, and Google knows a lot more about the Chrome userbase than you do.
      - vasachi 5y ago
        Google thought Google+ was a very good idea. Didn’t mean that it was a good idea. Removing features from web platform is, at least for me, a very bad move. If only because that it will spawn millions of half-baked replacement libraries with a whole lot of other security problems.
        roenxi 5y ago
        Yeah, you disagree with Google. They might be wrong and you might be right. That isn't important though. You need to make an argument about why you are right and why they are wrong. If your argument is you just don't like it, then Google has a multi-billion person user-base made up of people who trust Google's opinions on how to make a web browser more than literally anyone else. Even if every HN reader doesn't like what Google is doing here, that still doesn't mean anything except that the tech community doesn't like it. The tech community sometimes doesn't like things that are, nevertheless, good decisions. And, on the point at hand, I don't see why getting rid of an alert box is a bad idea. They are kind of annoying. I don't think removing them is a reasonable example of monopolistic excess.
bouncycastle 5y ago
Imagine all the XSS examples it would break!
- K5EiS 5y ago
  alert("you have been hacked")
ceronman 5y ago
This is definitely not the most important reason to keep `alert`, but I'd like to share it anyway: My girlfriend recently decided that she wants to learn programming. Given that she already knows some HTML and CSS, I thought JavaScript was the best option as her very first language, as she could apply what she learns easily. So I decided to teach her programming with JS. In these lessons I've been teaching her how to do basic input and output using `alert`, `prompt` and `confirm`. I know these are almost never used in professional projects, but for beginners these are very practical. They are easy to use and you can test everything in the browser without having to deal with all the overwhelming complexity of the usual JS toolchains. It's so sad that they are going away :( This definitely would make JS a bit less appealing for the complete beginner.
- pgo 5y ago
  No, this is about alerts from cross origin content, like from an iframe that loads from a different origin than the parent page
  - ceronman 5y ago
    It would still break sites like codepen.io that use iframes for this.
    - gregoriol 5y ago
      codepen's iframes are their own, not cross-origin
      - mcintyre1994 5y ago
        They're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookies on codepen.io and don't want them exposed to the iframe. See these tweets by their cofounder: https://twitter.com/chriscoyier/status/1422940724295786503?s=20 https://twitter.com/chriscoyier/status/1422940724295786503?s... and https://twitter.com/chriscoyier/status/1420033471376920578?s=20 https://twitter.com/chriscoyier/status/1420033471376920578?s...
underwater 5y ago
Google has an engineering culture that is biased towards chasing the next big thing. If you're not building something new and noteworthy then it's not valuable. This is good for Google as a business, but can hurt consumers by leaving them with dead and dying products. On the other hand, the web is powerful because it is ubiquitous, stable, and democratised. So you take Google engineers, coach them and reward them for demonstrating impact through building new features. Change is good, stability is bad. Then you put them in charge of the web platform. The natural result is an avalanche of new standards and an inclination to discount the status quo.
- underwater 5y ago
  As a tangible example, in response to this one Chrome engineer Tweeted "breaking changes happen often on the web, and as a developer it's good practice to test against early release channels of major browsers to learn about any compatibility issues upfront." That strikes me as the wrong attitude when you're working on the web. Change should be a last resort, not an expected side effect of you achieving some other goal.
  - tasogare 5y ago
    Also since web browsers are taking more and more of the operating systems responsabilities (providing API to buid applications) they should be more careful with compatibility of applications. Reversing the responsability is not acceptable. Coincidentally I just got burned today by some of those Chrome changes: a web app I'm developping has its container exposed on port 10080 for some reason. Impossible to open it with Chrome, because it decided most ports are now "dangerous". Took me 10 minutes to figure out, as it was working fine before. As relaunching the thing involve some manual steps, I solve the problem using Safari... It is becoming more and more difficult to do things not vetted by Google, and that's scary.
AltruisticGapHN 5y ago
At some point we'll need to weigh security vs usability... I'm getting tired of seeing my browser becoming less and less open. Can we not put somekind of VM environment around the entire browser, so that it's not an entry door to someone's OS ?
- gregoriol 5y ago
  The security issues with alert is not about getting access to the OS, but having a third-party (cross-origin iframe) display a message to the user, when the user doesn't know that the message is not from the site they are visiting.
  - asddubs 5y ago
    they say they want to get rid of first party alert as well though, and don't offer any sort of opt-out for trusted iframes
    - feikname 5y ago
      They also could very well improve the cross-origin alerts to say "This message is from ANOTHER website embedded in this tab, please act carefully. (source: xxx.com)" instead of outright removing it.
heybrendan 5y ago
The chromium bug from the TFA [1] *only* has 76 comments, as of writing this. Seventy six. Out of millions of users. And of those 76, it's not all pro-revert rhetoric. Any outrage here caused by the upstream changes seems quite hyperbolic. As a user, I'm annoyed my browser will now be subject to a flawed implementation for however much longer it now takes to revert the reversion (de-facto standard or not). I most certainly can't be alone in this stance. While I empathize a subset of developers may have been caught off guard by changes, my empathy has limits: their inconvenience is not worth my browser safety. Why must users suffer at the hand of a few chest-thumping devs? A little deference for history I think would also go a long way here: time and again Google has to kick the industry hard in it's complacency [2][3]. How quickly the industry seems to have forgotten that not all that long ago, developers [and administrators] had to be dragged kicking and screaming like toddlers, to support HTTPS adoption (and corresponding changes to the chrome UI). Was that change difficult then? You bet. Was it a net-good change in the long run? Hell yes. As Bruce Wayne said to Alfred after laying waste to League of Shadow's headquarters in Nolan's Batman Begins: "People need dramatic examples to shake them out of apathy [...]" Chrome Security team, if you're reading this, keep on trucking. - [1] https://bugs.chromium.org/p/chromium/issues/detail?id=1065085 https://bugs.chromium.org/p/chromium/issues/detail?id=106508... - [2] https://bugs.chromium.org/p/chromium/issues/detail?id=1065085#c69 https://bugs.chromium.org/p/chromium/issues/detail?id=106508... - [3] https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here...
- toyg 5y ago
  The HTTPS adoption switch worked only because Let's Encrypt happened. Otherwise people would have screamed blue murder.
- edent 5y ago
  How many of those millions of users know where to report a bug? How many of those who know, have reported or commented on bugs which have never been fixed?
- vasachi 5y ago
  Yes, please, make my browsing more secure by removing first party alerts. So much security will be achieved /s
riho 5y ago
Perhaps a controversial take, but I would be happy to see alerts removed altogether. I'm sure someone can point to a few legitimate uses of them, but in the grand scheme of things, they're usually terrible for user experience, as they block everything else (which is the point). This is also often used as a way to scam less computer literate people with "microsort security" alerts, that keep getting reopened when closed. I get that there are lots of JS tutorials out there that use it as a way to show simple interactions, but that's a very weak argument for keeping an API that is potentially harmful.
- phpnode 5y ago
  You're underestimating the level of breakage here, it's not just a few tutorial sites it's tens of millions of websites, many unmaintained. Like them or not alert(), confirm() and prompt() are key pieces of functionality depended on for literally decades now. I'm trying to imagine the economic cost of this change and it's just enormous.
  - riho 5y ago
    I understand that. But that was the case with popups as well. Remember when we needed popup blockers? Straight up removing the functionality is of course a drastic measure, so realistically I could see something like what we did with popups, where the browser first asks you if you'd like to allow alerts on the page, and only allow them to be shown if the user explicitly chooses so.
    - pjmlp 5y ago
      I still see them everywhere.
    - pineconewarrior 5y ago
      This is the fix. Deprecate alerts gracefully in favor of the native dialogue element!
  - user5994461 5y ago
    It's only blocking when inside an iframe. There may be millions of sites using these functions legitimately, but not inside an iframe.
arrftr 5y ago
Duplicate: https://news.ycombinator.com/item?id=28055160 https://news.ycombinator.com/item?id=28055160
- cratermoon 5y ago
  The story itself even points back to that!
- kdmccormick 5y ago
  I don't think this is a duplicate. This story is reporting on how Chromium is (at least, temporarily) restoring support for alert/prompt/confirm from cross-origin iframes.

100 points by kiyanwang 5y ago

When they say they need to remove alert completely because it blocks the main thread you can see how disconnected from reality they are.

gregoriol 5y ago
This is indeed a very strange argument against alerts.
GordonS 5y ago
That is... a rather odd argument. As a user, why would I care if the main thread is blocked while a modal alert is displayed? If anything, that's probably the expected behaviour! An argument I could understand would be that `alert` etc look like system prompts, rather than something from the browser - but that's a browser concern that Chrome, Firefox, Edge, Safari etc could easily solve if they wanted.

vasachi 5y ago

This is what you get, when google has monopoly on the web platform. They will drop support for standards, because they want to and they can. And we won’t have any say in their decisions. I mean, the gall they have to shove their burden onto us, the developers. Google is a trillion dollar company. If they think, that alerts are confusing, they have all the money in the world to make them not confusing. But, I guess, dropping support is what google usually does.

encryptluks2 5y ago
This isn't about support, it is a sane security decision. Imagine finding that a door to your large shared office space is missing and people were coming in and stealing things. So you install a new door and suddenly people start saying... How dare you put a door there that people were using to steal things. The gall you must have to shove this burden onto us.
- vasachi 5y ago
  Here’s the thing. It is not our problem that google doesn't want to make alerts less confusing. They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. How are they a security problem?
  - encryptluks2 5y ago
    This is about CSRF. Ever heard the phrase blinded by hate or blind hatred?
    - minitech 5y ago
      How are alert and CSRF related at all?
      - encryptluks2 5y ago
        Because this is specifically in regarding to calling them from an iframe.
  - jeffchien 5y ago
    > They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. Can you cite this? Or is this just wild speculation?
    - vasachi 5y ago
      The Register cites this: https://github.com/whatwg/html/issues/6897#issuecomment-885773622 https://github.com/whatwg/html/issues/6897#issuecomment-8857... Also this: https://twitter.com/Rich_Harris/status/1422930436850860033 https://twitter.com/Rich_Harris/status/1422930436850860033
      - jeffchien 5y ago
        Thank you!
lucideer 5y ago
> drop support for standards alert was never a W3C standard. It was a non-standard browser feature that happened to be widely implemented in the early days of the web. It was never part of any planned/agreed addition of well-thought-out features to the web. The only time it has been "standardized" is when the WHATWG recently decided it would be a good idea to describe the behaviour of all the legacy non-standard browser APIs that have been lying around in browser implementations since the early days of Javascript's existence. The WHATWG have strictly described this behaviour for alert within the "User Prompts" section of the HTML specification: a new section to describe an ancient function.
- 0x0nyandesu 5y ago
  It being part of every browser makes it a defacto standard.
  - lucideer 5y ago
    If it were only a defacto standard I'd say they'd be even more justified in deprecation. It is now an actual standard though; I was just pointing out the history and reasoning behind its addition to the current standard. Given its WHATWG policy to define and codify the behaviour of every feature ever added broadly, if we believe no standard should ever be deprecated we'll never be able to deprecate anything at all and be stuck with every bad decision ever made.
  - UncleMeat 5y ago
    Are you equally mad about moves to eliminate cross-origin cookies? That was part of every browser.
- BulgarianIdiot 5y ago
  W3C doesn't matter much, WHATWG is the spec we follow, W3C just chases after them. So don't equate "standards" with "W3C standards".
  - SahAssar 5y ago
roenxi 5y ago
> This is what you get, when google has monopoly on the web platform. This isn't even an obviously bad idea. It is bad for web developers, but I don't think it is easy to argue that web developers are the most important demographic for Google to cater to. If this is the sort of terror that monopolies are meant to be inflicting then the concept is barely important enough to get a mention. I don't like Google, and I remember the IE6 days. When Chrome is even a little comparable to what MS used to manage then maybe people should start complaining. This is nothing.
- vasachi 5y ago
  What? Why should we tolerate bad behavior? Only because it’s less bad than Microsoft’s? That is not a very high bar, you know.
  - roenxi 5y ago
    We shouldn't tolerate bad behaviour. But you'll have to make an argument that it is bad behaviour. Google thinks this is a good idea, and Google knows a lot more about the Chrome userbase than you do.
    - vasachi 5y ago
      Google thought Google+ was a very good idea. Didn’t mean that it was a good idea. Removing features from web platform is, at least for me, a very bad move. If only because that it will spawn millions of half-baked replacement libraries with a whole lot of other security problems.
      - roenxi 5y ago
        Yeah, you disagree with Google. They might be wrong and you might be right. That isn't important though. You need to make an argument about why you are right and why they are wrong. If your argument is you just don't like it, then Google has a multi-billion person user-base made up of people who trust Google's opinions on how to make a web browser more than literally anyone else. Even if every HN reader doesn't like what Google is doing here, that still doesn't mean anything except that the tech community doesn't like it. The tech community sometimes doesn't like things that are, nevertheless, good decisions. And, on the point at hand, I don't see why getting rid of an alert box is a bad idea. They are kind of annoying. I don't think removing them is a reasonable example of monopolistic excess.

bouncycastle 5y ago

Imagine all the XSS examples it would break!

K5EiS 5y ago
alert("you have been hacked")

ceronman 5y ago

This is definitely not the most important reason to keep `alert`, but I'd like to share it anyway: My girlfriend recently decided that she wants to learn programming. Given that she already knows some HTML and CSS, I thought JavaScript was the best option as her very first language, as she could apply what she learns easily. So I decided to teach her programming with JS. In these lessons I've been teaching her how to do basic input and output using `alert`, `prompt` and `confirm`. I know these are almost never used in professional projects, but for beginners these are very practical. They are easy to use and you can test everything in the browser without having to deal with all the overwhelming complexity of the usual JS toolchains. It's so sad that they are going away :( This definitely would make JS a bit less appealing for the complete beginner.

pgo 5y ago
No, this is about alerts from cross origin content, like from an iframe that loads from a different origin than the parent page
- ceronman 5y ago
  It would still break sites like codepen.io that use iframes for this.
  - gregoriol 5y ago
    codepen's iframes are their own, not cross-origin
    - mcintyre1994 5y ago
      They're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookies on codepen.io and don't want them exposed to the iframe. See these tweets by their cofounder: https://twitter.com/chriscoyier/status/1422940724295786503?s=20 https://twitter.com/chriscoyier/status/1422940724295786503?s... and https://twitter.com/chriscoyier/status/1420033471376920578?s=20 https://twitter.com/chriscoyier/status/1420033471376920578?s...

underwater 5y ago

Google has an engineering culture that is biased towards chasing the next big thing. If you're not building something new and noteworthy then it's not valuable. This is good for Google as a business, but can hurt consumers by leaving them with dead and dying products. On the other hand, the web is powerful because it is ubiquitous, stable, and democratised. So you take Google engineers, coach them and reward them for demonstrating impact through building new features. Change is good, stability is bad. Then you put them in charge of the web platform. The natural result is an avalanche of new standards and an inclination to discount the status quo.

underwater 5y ago
As a tangible example, in response to this one Chrome engineer Tweeted "breaking changes happen often on the web, and as a developer it's good practice to test against early release channels of major browsers to learn about any compatibility issues upfront." That strikes me as the wrong attitude when you're working on the web. Change should be a last resort, not an expected side effect of you achieving some other goal.
- tasogare 5y ago
  Also since web browsers are taking more and more of the operating systems responsabilities (providing API to buid applications) they should be more careful with compatibility of applications. Reversing the responsability is not acceptable. Coincidentally I just got burned today by some of those Chrome changes: a web app I'm developping has its container exposed on port 10080 for some reason. Impossible to open it with Chrome, because it decided most ports are now "dangerous". Took me 10 minutes to figure out, as it was working fine before. As relaunching the thing involve some manual steps, I solve the problem using Safari... It is becoming more and more difficult to do things not vetted by Google, and that's scary.

AltruisticGapHN 5y ago

At some point we'll need to weigh security vs usability... I'm getting tired of seeing my browser becoming less and less open. Can we not put somekind of VM environment around the entire browser, so that it's not an entry door to someone's OS ?

gregoriol 5y ago
The security issues with alert is not about getting access to the OS, but having a third-party (cross-origin iframe) display a message to the user, when the user doesn't know that the message is not from the site they are visiting.
- asddubs 5y ago
  they say they want to get rid of first party alert as well though, and don't offer any sort of opt-out for trusted iframes
  - feikname 5y ago
    They also could very well improve the cross-origin alerts to say "This message is from ANOTHER website embedded in this tab, please act carefully. (source: xxx.com)" instead of outright removing it.

heybrendan 5y ago

The chromium bug from the TFA [1] *only* has 76 comments, as of writing this. Seventy six. Out of millions of users. And of those 76, it's not all pro-revert rhetoric. Any outrage here caused by the upstream changes seems quite hyperbolic. As a user, I'm annoyed my browser will now be subject to a flawed implementation for however much longer it now takes to revert the reversion (de-facto standard or not). I most certainly can't be alone in this stance. While I empathize a subset of developers may have been caught off guard by changes, my empathy has limits: their inconvenience is not worth my browser safety. Why must users suffer at the hand of a few chest-thumping devs? A little deference for history I think would also go a long way here: time and again Google has to kick the industry hard in it's complacency [2][3]. How quickly the industry seems to have forgotten that not all that long ago, developers [and administrators] had to be dragged kicking and screaming like toddlers, to support HTTPS adoption (and corresponding changes to the chrome UI). Was that change difficult then? You bet. Was it a net-good change in the long run? Hell yes. As Bruce Wayne said to Alfred after laying waste to League of Shadow's headquarters in Nolan's Batman Begins: "People need dramatic examples to shake them out of apathy [...]" Chrome Security team, if you're reading this, keep on trucking. - [1] https://bugs.chromium.org/p/chromium/issues/detail?id=1065085 https://bugs.chromium.org/p/chromium/issues/detail?id=106508... - [2] https://bugs.chromium.org/p/chromium/issues/detail?id=1065085#c69 https://bugs.chromium.org/p/chromium/issues/detail?id=106508... - [3] https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here...

toyg 5y ago
The HTTPS adoption switch worked only because Let's Encrypt happened. Otherwise people would have screamed blue murder.
edent 5y ago
How many of those millions of users know where to report a bug? How many of those who know, have reported or commented on bugs which have never been fixed?
vasachi 5y ago
Yes, please, make my browsing more secure by removing first party alerts. So much security will be achieved /s

riho 5y ago

Perhaps a controversial take, but I would be happy to see alerts removed altogether. I'm sure someone can point to a few legitimate uses of them, but in the grand scheme of things, they're usually terrible for user experience, as they block everything else (which is the point). This is also often used as a way to scam less computer literate people with "microsort security" alerts, that keep getting reopened when closed. I get that there are lots of JS tutorials out there that use it as a way to show simple interactions, but that's a very weak argument for keeping an API that is potentially harmful.

phpnode 5y ago
You're underestimating the level of breakage here, it's not just a few tutorial sites it's tens of millions of websites, many unmaintained. Like them or not alert(), confirm() and prompt() are key pieces of functionality depended on for literally decades now. I'm trying to imagine the economic cost of this change and it's just enormous.
- riho 5y ago
  I understand that. But that was the case with popups as well. Remember when we needed popup blockers? Straight up removing the functionality is of course a drastic measure, so realistically I could see something like what we did with popups, where the browser first asks you if you'd like to allow alerts on the page, and only allow them to be shown if the user explicitly chooses so.
  - pjmlp 5y ago
    I still see them everywhere.
  - pineconewarrior 5y ago
    This is the fix. Deprecate alerts gracefully in favor of the native dialogue element!
- user5994461 5y ago
  It's only blocking when inside an iframe. There may be millions of sites using these functions legitimately, but not inside an iframe.

arrftr 5y ago

Duplicate: https://news.ycombinator.com/item?id=28055160 https://news.ycombinator.com/item?id=28055160

cratermoon 5y ago
The story itself even points back to that!
kdmccormick 5y ago
I don't think this is a duplicate. This story is reporting on how Chromium is (at least, temporarily) restoring support for alert/prompt/confirm from cross-origin iframes.