Comments on: oFrameBust: Proposed Protocol for iFrame Choice

By: jtresidder

jtresidder — Wed, 15 Apr 2009 09:04:53 +0000

Anyone?

By: jtresidder

jtresidder — Tue, 14 Apr 2009 09:19:42 +0000

“‘iframing’ by some, e.g. facebook and digg, adds value to your site”

It does? Is that greater than the value it detracts by link stealing?

By: Schill

Schill — Tue, 14 Apr 2009 01:59:03 +0000

@narcvs: For removing the bar on links within your site when framed, assigning links’ targets to point to _top might(?) work if you really wanted to break out of the frameset only when leaving the present page.

Placing sites in an iFrame is also part of how clickjacking attacks are set up, so it’s probably a good thing that NoScript blocks them. (Presumably only when they point to 3rd-party domains, I’m not familiar with how it works.)

By: mdmadph

mdmadph — Mon, 13 Apr 2009 19:20:01 +0000

Ugh — I’ll just stick to my old-fashioned frame breakout for all sites — I can’t stand when sites do this, as it breaks NoScript’s functionality for me.

By: Darkimmortal

Darkimmortal — Mon, 13 Apr 2009 18:29:19 +0000

Check refer[r]er header on the server. If it matches a blacklist entry, add simple frame escaping Javascript code along with a backup to apply the necessary CSS to hide the page and replace it with whatever.

By: narcvs

narcvs — Mon, 13 Apr 2009 17:17:53 +0000

@Schill I think you’re right – I completely overlooked referrer while playing around with this, and assuming that it work reliably for iframes across browsers and cannot be spoofed, there is really no need for oframebust!

One problem it could still potentially solve is the issue of removing the bar once the user navigates away. Could we perhaps use it to communicate to the top frame that the user has navigated away to a new page?

Cheers,
Marcus