Hacker News Reader

Iframes will never go away.

But we need a way to tell a browser "if you embed this page into an iframe, it needs to be the topmost content, no transform/translate/visibility or anything". Social/login iframe would set that flag, and it would prevent the clickjacks and attacks like this.

View on HN

All websites are supposed to set the header X-Frame-Options: DENY to block iframes. It's a solved problem.

That doesn't solve the issue of clickjacking attempts on pages meant to be in iframes (FB like buttons are in iframes)

That solves clickjacking for things which don't want to be iframed, but not for things like the Like button or login buttons which specifically need to be embedded into an existing page (and they were the attack vector for this article)

Reply on news.ycombinator.com