Hacker News Reader

Comment by rsj_hn | Hacker News Reader

Using an iframe sandbox has some issues:

1. scrollbars and positioning can cause problems with iframes that an inline div doesn't have, especially if there are multiple small iframes on the page.

2. As soon as you allow script in the sandbox iframe, then you are susceptible to these types of fingerprinting attacks. The fact that you have origin isolation doesn't really block what the ad was doing. This is because iframe sandbox was never designed to block fingerprinting attacks, it was design to create a separate origin that gave the dev broad control over features like 'allow js' 'allow access to origin', etc.

View on HN

>1. scrollbars and positioning can cause problems with iframes that an inline div doesn't have, especially if there are multiple small iframes on the page.

I'm not quite sure what you mean here, but I'm curious. Have any examples?

Ideally you would like the iframe to not be visible -- you don't want it to show scrollbars if the content overflows.

But at the same time, you want to see all the content in the iframe. If you knew ahead of time exactly the layout of the text in the iframe you could do this, but it's harder when you have dynamically generated content inserted into the iframe, and now add to that wanting the page to be on different devices with different viewports, resolutions, users resizing the page, users increasing or decreasing text sizes for accessibility or changing default fonts.

And if you don't control the content, some of it may contain fixed size elements or absolute positioning inside the frame.

It's a really difficult problem that we were struggling with before ultimately giving up on trying to use iframes for this purpose. And when you make a mistake you either get ugly scrollbars in your iframe or part of your content is cut off when the user resizes the page.

Solving this problem requires the JS on the parent and child frames to cooperate and talk to each other about their sizes, so the parent can resize the iframe to match the size of its content. This is not something ad providers would bother to implement on their own, let alone in a consistent way.

Correct, there are solutions, but in our case none of them were feasible because we didn't control what was happening inside the iframe.

Reply on news.ycombinator.com