3 ms·

This is a big security problem with iframes. I have hoped for years that developers of the major browsers should understand this and automatically change the ad

by kkaa 12y ago

This is a big security problem with iframes. I have hoped for years that developers of the major browsers should understand this and automatically change the adress bar to the iframes url when the iframe is having focus. Problem solved!

patcheudor 12y ago
Not really problem solved so long as browsers continue to have cross frame scripting (XFS) issues. There are also issues surrounding which iframe to enumerate in the address bar. Finally, additional attacks would surely arise. Because the host domain still owns the DOM it could overwrite the region where the iframe is presented, knowing that the address bar would change to a trusted domain. In short I see this sort of solution leading to major problems.
- kkaa 12y ago
  I do not agree with you! Cross frame scripting is not a problem today. If it was a problem PayPal would never use this UI. And for my solution: If I place the cursor for example in the password input, then the address bar of the browser would show the iframe url, so the enumeration is not a problem. And if the parent site places anything over the iframe, who cares, since it can not fake the address bar of the browser. The point of this solution is to give the user the possibility to verify what site the iframe belongs to. Their is only solution today to verify if the iframe is legitimate or not and that is to include a link in the iframe that the user can click on (With the text: Is this a legitimate login form?). This links opens up a new browser tab and in that tab PayPal checks the referrer. If the referrer comes from PayPal (the iframe) we know that this iframe is not a fake one and can present that information to the user.
jfoster 12y ago
That problem burdens the user with constantly checking whether the address bar has changed on every interaction they have with the site. Currently, browsers are still trying to train users to check the address bar just once before putting their credentials into a site. Even for technically slanted users, checking the address bar on every interaction would be a bit too much to ask, I think.

by kkaa 12y ago

patcheudor 12y ago

Not really problem solved so long as browsers continue to have cross frame scripting (XFS) issues. There are also issues surrounding which iframe to enumerate in the address bar. Finally, additional attacks would surely arise. Because the host domain still owns the DOM it could overwrite the region where the iframe is presented, knowing that the address bar would change to a trusted domain. In short I see this sort of solution leading to major problems.

kkaa 12y ago
I do not agree with you! Cross frame scripting is not a problem today. If it was a problem PayPal would never use this UI. And for my solution: If I place the cursor for example in the password input, then the address bar of the browser would show the iframe url, so the enumeration is not a problem. And if the parent site places anything over the iframe, who cares, since it can not fake the address bar of the browser. The point of this solution is to give the user the possibility to verify what site the iframe belongs to. Their is only solution today to verify if the iframe is legitimate or not and that is to include a link in the iframe that the user can click on (With the text: Is this a legitimate login form?). This links opens up a new browser tab and in that tab PayPal checks the referrer. If the referrer comes from PayPal (the iframe) we know that this iframe is not a fake one and can present that information to the user.

jfoster 12y ago

That problem burdens the user with constantly checking whether the address bar has changed on every interaction they have with the site. Currently, browsers are still trying to train users to check the address bar just once before putting their credentials into a site. Even for technically slanted users, checking the address bar on every interaction would be a bit too much to ask, I think.