3 ms·
> clickjacking. That’s when, for example, a website frames your site, then hijacks user input such that users are fooled into thinking they’re interacting with
by infotogivenm 4y ago
> clickjacking. That’s when, for example, a website frames your site, then hijacks user input such that users are fooled into thinking they’re interacting with your site while they’re actually providing data to the (evil) containing site. Imagine typing your bank credentials into (what you think is) your bank website, whereas it’s in fact an evil site logging everything you’ve typed
Nitpick but isn’t this backwards? e.g. a clickjacking attack tricks you into thinking you are interacting with a harmless site, when in actuality you are clicking “buy now” on amazon in an invisible logged-in iframe.
- mtlynch 4y agoYou're right. They have it backwards. It's the legitimate site that needs to protect itself from being invisibly framed within a malicious site.
- vgel 4y agoIt can happen either way I think. The reverse is framing Amazon but overlaying an evil credit card input invisibly on top of Amazon's.
- remram 4y agoThat is just straight-up phishing, showing a fake Amazon form on your website that is served from a different domain. I'm not sure what you would overlay there. Obviously you can't overlay anything for people who visit amazon.com, because they are not talking to your server at all.