Hacker News Reader

It suddenly occurs to me that in addition to it being rude to deep-link someone's content via <iframe>, it may be dangerous to Daily Mail's security model.

I wonder if they've configured everything correctly to ensure that an embedded iframe can't find its way to the user's Daily Mail cookies or credentials?

View on HN

The browser's built-in same origin policy will prevent the iframed content from being able to access cookies in the containing frame because it is being hosted from a different domain.

What about just changing what the Daily Mail is serving up? An image referring to the Daily Mail stealing content for example.

Reply on news.ycombinator.com