5 ms·

In cases like this, asking users for information, especially for payment details, for a different site than the user is visiting (e.g. PayPal) should be done us

by spartas 12y ago

In cases like this, asking users for information, especially for payment details, for a different site than the user is visiting (e.g. PayPal) should be done using separate windows or iframes. Period. Additionally, the specification for visible iframes should make it clear to the user the iframe’s document URL. The iframe itself should have its own non-editable URL address bar, including an interactable area to allow the user to request information about the security details of the framed page for pages requested over SSL/TLS.

muglug 12y ago
But it would be very easy to forge any secure iframe address bar using JS/CSS.
- spartas 12y ago
  The bar would be part of the user agent's iframe element, not accessible via JS/CSS. Sure, you could overlay an element on top of the bar with JS/CSS, and some thought would have to be put in to avoid that type of forgery.
  - ascorbic 12y ago
    The spoof element wouldn't need to be an iframe though. They could use any element and apply fake "secure iframe" styling.
idbehold 12y ago
The method PayPal is using right now, the one mentioned in the article, utilizes iframes. > The iframe itself should have its own non-editable URL address bar This would definitely be good for security, but I feel like it would probably be overkill for many other iframe use cases. Think about every YouTube embed having an address bar. And what about the "hidden" iframes that are only 1x1, do you still show an address bar? Do you set a minimum size for iframes?
- spartas 12y ago
  Obviously there would need some additional thought put into this. It might be a net-positive for every YouTube embedded video to have an address bar (copy from the iframe url and paste the embed URL into the browser's address bar, YouTube could detect that it's not being loaded into a frame and take the user to the standard video page). As far as the 1x1 and minimum frame size, I don't know. 1x1 iframes are usually hidden (is there any point to having them visible?). I don't think it's a specification's place to enforce minimum size limits for elements (frames or otherwise). Perhaps the user agent could display a button that the user could interact with if the iframe size were smaller than a certain size.
- wlesieutre 12y ago
  And would be trivial to spoof by just drawing your own address bar. Bonus points for detecting browser/OS and drawing the appropriate version. The certificate verification UI in browsers only works because it's outside of the area that a website could display a fake one in. You'd need some kind of indicator tied to the iframe from outside the web view, otherwise they'll end up like the ads that looks like popup windows to trick you into clicking the close button.
TheDong 12y ago
Thinking that an iframe will work here is fundamentally flawed unless the verifying metadata resides wholly outside of the browser's content window. Even if you require the iframe to have some specific styling and make it so the parent DOM cannot edit it, we're talking about spoofing. With html, js, and css you can reproduce absolutely any iframe styling by simply not using an iframe and pretending you are. If you were to put the iframe's true url in the location bar e.g. having url: https://github.com/fragement https://github.com/fragement | selected: https://paypal.com/fragment https://paypal.com/fragment then that could sovle the problem however. Browsers cannot edit domains in the location bar so this could work, but your suggestion absolutely doesn't. Furthermore, I don't think the idea I outline above is a good idea because it requires users to learn something more. I'd rather just have the "redirect to and redirect back when done" solution since people have already learned to check "am I on paypal, does my address bar say paypal, is my ssl cert thingy green" and relearning to check "is my selected url paypal even though I'm on github" is not something that would happen quick enough in my mind.

by spartas 12y ago

muglug 12y ago

But it would be very easy to forge any secure iframe address bar using JS/CSS.

spartas 12y ago
The bar would be part of the user agent's iframe element, not accessible via JS/CSS. Sure, you could overlay an element on top of the bar with JS/CSS, and some thought would have to be put in to avoid that type of forgery.
- ascorbic 12y ago
  The spoof element wouldn't need to be an iframe though. They could use any element and apply fake "secure iframe" styling.

idbehold 12y ago

The method PayPal is using right now, the one mentioned in the article, utilizes iframes. > The iframe itself should have its own non-editable URL address bar This would definitely be good for security, but I feel like it would probably be overkill for many other iframe use cases. Think about every YouTube embed having an address bar. And what about the "hidden" iframes that are only 1x1, do you still show an address bar? Do you set a minimum size for iframes?

spartas 12y ago
Obviously there would need some additional thought put into this. It might be a net-positive for every YouTube embedded video to have an address bar (copy from the iframe url and paste the embed URL into the browser's address bar, YouTube could detect that it's not being loaded into a frame and take the user to the standard video page). As far as the 1x1 and minimum frame size, I don't know. 1x1 iframes are usually hidden (is there any point to having them visible?). I don't think it's a specification's place to enforce minimum size limits for elements (frames or otherwise). Perhaps the user agent could display a button that the user could interact with if the iframe size were smaller than a certain size.
wlesieutre 12y ago
And would be trivial to spoof by just drawing your own address bar. Bonus points for detecting browser/OS and drawing the appropriate version. The certificate verification UI in browsers only works because it's outside of the area that a website could display a fake one in. You'd need some kind of indicator tied to the iframe from outside the web view, otherwise they'll end up like the ads that looks like popup windows to trick you into clicking the close button.

TheDong 12y ago

Thinking that an iframe will work here is fundamentally flawed unless the verifying metadata resides wholly outside of the browser's content window. Even if you require the iframe to have some specific styling and make it so the parent DOM cannot edit it, we're talking about spoofing. With html, js, and css you can reproduce absolutely any iframe styling by simply not using an iframe and pretending you are. If you were to put the iframe's true url in the location bar e.g. having url: https://github.com/fragement https://github.com/fragement | selected: https://paypal.com/fragment https://paypal.com/fragment then that could sovle the problem however. Browsers cannot edit domains in the location bar so this could work, but your suggestion absolutely doesn't. Furthermore, I don't think the idea I outline above is a good idea because it requires users to learn something more. I'd rather just have the "redirect to and redirect back when done" solution since people have already learned to check "am I on paypal, does my address bar say paypal, is my ssl cert thingy green" and relearning to check "is my selected url paypal even though I'm on github" is not something that would happen quick enough in my mind.