Comments on: iframes are evil

By: Gareth Heyes

Gareth Heyes — Mon, 10 Sep 2007 10:03:43 +0000

I’m so sorry about the code in comments, I’ve finally taken the time to update my security plugin and encoded the correct characters. You should be able to post code on the blog now without it being stripped out.

By: Gareth Heyes

Gareth Heyes — Mon, 10 Sep 2007 07:25:34 +0000

@Evert

Yeah I wish that would happen sooner rather than later.

By: Gareth Heyes

Gareth Heyes — Mon, 10 Sep 2007 07:24:12 +0000

Yeah I know I’m sorry. I didn’t write the code on this blog, I’m gonna sort it out.

By: digi7al64

digi7al64 — Mon, 10 Sep 2007 04:35:59 +0000

meh - sorry but no matter what i do it just doesn’t render right.

Honestly no offence to yourself Gareth but this sucks, we can post comments that use greater or less then signs. i mean how hard is it to encode em rather then delete them?

By: digi7al64

digi7al64 — Mon, 10 Sep 2007 04:33:54 +0000

oops. forgot to wrap the code

false
true

By: digi7al64

digi7al64 — Mon, 10 Sep 2007 04:30:45 +0000

the problem with your solution is that if a page is hacked via persistant xss then “” could be overwritten or excluded. What we need is a new document that resides on servers that dictate was rules the browser should follow. similar to
crossdomain.xml but with more clout

true
false

This way by setting flags for true or false based on the domain you eleminate a lot of the remote inclusions that cause issues

By: Evert

Evert — Sun, 09 Sep 2007 23:21:32 +0000

I’m just waiting for the day when we can include a security profile per site, allowing use to disable javascript altogether, iframes, javascript accessing cookies, etc, etc..

By: Gareth Heyes

Gareth Heyes — Sun, 09 Sep 2007 15:32:12 +0000

Yeah that would be a fantastic feature in noscript, also removing the visited attribute in CSS, window.open etc

By: Bipin 3~ Upadhyay

Bipin 3~ Upadhyay — Sun, 09 Sep 2007 12:49:24 +0000

It’s a strange coincidence (though not such a big one for the world to celebrate :P).
I had some similar feelings after looking at “several” attacks possible using iframes (including the CSS ones). The most prominent being the recent “Bank Of India” hack, where the attackers used iframes to download malware on the users system (please correct me if I am mistaken).
I was in fact thinking of initiating a discussion thread on Slackers and….. go the extent of requesting Maone to include an option to disable iframes in NoScript.
IMHO, that’s the only way I see currently to save oneself in these CSS and drive-by download attack scenarios.