News for hackers. Stuff that matters.

A comment on elgooG. Parent comment

Re:elgooG by jeremydw on Wednesday April 01, 2015 @12:21AM (#9301574)
Generally, on pages/domains where you may provide users with a sign in box (such as the Google Accounts login page), you want to disallow other sites from iframing your page to prevent a clickjacking attack – http://en.wikipedia.org/wiki/Clickjacking

So Google.com busts out of cross-domain iframes by default to prevent attacks like this.

[ Parent | on HN ]
Re:elgooG by christop on Wednesday April 01, 2015 @12:34AM (#9301634)
Sure, and Google normally does disable iframing — the particular URL that com.google frames is configured to not serve the X-Frame-Options HTTP, allowing this trick to work. Clicking "Sign In" breaks out of the frame (target="_top").

But that goes for all browsers — I wonder why is Chrome for iOS is being singled out here?

[ Parent | on HN ]
Re:elgooG by kion on Wednesday April 01, 2015 @01:07AM (#9301739)
Chrome on iOS has some input handling issues inside the iframe.
[ Parent | on HN ]