News for hackers. Stuff that matters.

A comment on Google YOLO clickjacking.

Re:Google YOLO clickjacking by dandare on Friday May 11, 2018 @06:08AM (#17046079)
Quite common misunderstand about Clickjacking is the idea that a 3rd party content embedded in an iframe can hijack clicks from the parent (yours) website. While embedding an untrusted iframe in your website is not a god idea, the Clickjacking attack goes the other way around.
[ Parent | on HN ]
Re:Google YOLO clickjacking by politician on Friday May 11, 2018 @03:55PM (#17050377)
Why aren't events masked by the last several frames generated by the rendering system?

If a page is divided into two columns with the left half originating from the source origin and the right half from a delegated origin, why should the source origin observe interaction events from the right half, or vice versa?

We should be able to press a hotkey and immediately see at-a-glance who is operating what.

[ Parent | on HN ]
Re:Google YOLO clickjacking by shamas on Friday May 11, 2018 @09:31PM (#17051982)
Yeah, that took me a while to figure out just now. But I still don't see how that's an issue, I'm browsing on ycombinator.com, not ashittyiframesite.com
[ Parent | on HN ]