exactly, and vk.com (biggest social network in europe) is a showcase. They use such framebreaker:
if (parent && parent != window && (browser.msie || browser.opera || browser.mozilla || browser.chrome || browser.safari || browser.iphone)) {
document.getElementsByTagName('body')[0].innerHTML = '';
}
Isn't that exactly the kind of framebuster Boneh says doesn't work?
I don't think so, what bypasses this one? (besides sandbox and XSS Auditor trick)
Read the paper I posted up thread.
Table 2: Frame busting conditional statement
we consider following tricks:
document.write('')
setTimeout(function(){document.body.innerHTML='';},1);
window.self.onload = function(evt){document.body.innerHTML='';}
None of them was bypassed further in the paper. (I used Ctrl+F)
double checked http://seclab.stanford.edu/websec/framebusting/framebust.pdf there are many parent-navigation bypasses in this paper but nothing for innerHTML='' (not taking into account sandbox and xss auditor)
So there is a scenario in which browser support for sandboxed frames could cause problems for preexisting websites.