Re:HTML5 Sandbox - a bad idea
by kevingadd on Friday April 05, 2013 @11:42PM
(#5502545)
You failed to address his realistic criticism that many websites are not yet using X-Frame-Options. Browsers that introduce the sandbox feature have now broken those sites' security.
[ Parent
| on HN ]
I'm not sure what you mean -- how can the browser possibly break the sites security?
I understand that English is not everyone's first language, but I honestly had a hard time parsing the linked post.
Sandbox iframes allow disabling javascript in a frame, which disables framebusting protection [1] used by sites like vk.com. The better way to framebust is to add the header 'x-frame-options: deny', which isn't broken by html5 sandboxes.