>Homokov who's that guy? >But, most sites don't protect against CJ at all. This is definitely truth. Sad truth. >Of the sites that do, as many use XFO (the

>Homokov who's that guy? >But, most sites don't protect against CJ at all. This is definitely truth. Sad truth. >Of the sites that do, as many use XFO (the HTTP Header that denies reframing) as use JS framebusters. do you have statistics or something? Because I am not sure about this. IMHO, for now, framebreakers are more popular. XFO is still for well educated developers, framebreakers are old-school. > But that's a red herring in this case; what browser supports H5 Sandboxes but not XFO? I believe all do support. > rendering them on a page without losing control of Javascript can you elaborate this please? Because most people say 'something bad with JS'. SOmething what? What exactly bad is going to happen, besides prompt(1)? > CJ is an inherently less scary problem than XSS obviously, but XSS is unrelated threat here (or i missed something) > Oughtn't we just encourage everyone to set XFO, instead? I agree with you. NOW there is no way back, but 3 years ago people should have been more careful about security compatibility, IMO