Hacker News Reader

This wasn't CSRF, but clickjacking, aka UI redressing. CSRF protection does nothing against it. There are some ways to attempt to defend against it but I don't think there is any 100% reliable way yet.

http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_pag...

View on HN

Thank you for clarification. It seems that Twitter thinks (http://blog.twitter.com/2009/02/clickjacking-blocked.html) they are reliably defending against it. Someone will soon be trying to determine if theirs is "100% reliable" yet.

EDIT: So what do you think of the sufficiency of the "fix" as explained at: http://dsandler.org/outgoing/dontclick.html ?

this might be a way around it in IE

http://code.google.com/p/browsersec/wiki/Part3#Microsoft_Int...

and one way around this is http://keepitlocked.net/archive/2008/11/07/preventing-clickj...

They've just fixed this it seems. Content is now hidden in iframes.

Here's another way around it: http://coderrr.wordpress.com/2009/02/13/preventing-frame-bus...

Thanks for the link to Google's browsersec page, that's really useful. http://code.google.com/p/browsersec/wiki/Main

Reply on news.ycombinator.com