3 ms·

Sounds more like a design decision. Do you have any suggestions besides not using iframes?

• homakov 13y ago
  No, since there's no way to check iframe's domain I don't think it can be fixed for iframes. They should stop asking for user's password right there, because it makes people trust any iframe
  • fatbat 13y ago
    Maybe they can force login via their main site first. Lousier user experience though.
    • moe 13y ago
      Lousy user experience is not being able to verify what site I'm about to enter my payment credentials into.
      • pbreit 13y ago
        It would be a terrific experience if there was no reason to worry.