Hacker News Reader

The question is: what is "CriOS"?

Edit: Ah, it seems to be used in the "Chrome for iOS" user agent string.

Weird that it can't handle iframes(?). Or what's the reason for the JS on com.google that redirects only the "CriOS" user agent to www.google.com without framing?

View on HN

Generally, on pages/domains where you may provide users with a sign in box (such as the Google Accounts login page), you want to disallow other sites from iframing your page to prevent a clickjacking attack – http://en.wikipedia.org/wiki/Clickjacking

So Google.com busts out of cross-domain iframes by default to prevent attacks like this.

Sure, and Google normally does disable iframing — the particular URL that com.google frames is configured to not serve the X-Frame-Options HTTP, allowing this trick to work. Clicking "Sign In" breaks out of the frame (target="_top").

But that goes for all browsers — I wonder why is Chrome for iOS is being singled out here?

Chrome on iOS has some input handling issues inside the iframe.

Reply on news.ycombinator.com