I have done extensive research in this area as well - my code is used in production by 100,000 users, by another company. I personally always choose to go with

I have done extensive research in this area as well - my code is used in production by 100,000 users, by another company. I personally always choose to go with direct contentEditable without an iframe. It makes things much easier. However, what the author did not mention was security. My assumption as to why the company that uses my code, still uses it inside an iframe, is to prevent accidental XSS injection from when their user's copy and paste content (sometimes with javascript embedded in it) into the editor. So be careful about that. Another recommendation I have, is to NOT use execCommand.