Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread John Tamplin
On Tue, Aug 2, 2011 at 7:15 AM, Dennis Joachimsthaler wrote: > Am 02.08.2011, 13:12 Uhr, schrieb Anne van Kesteren > >> If users cannot trust their userscripts and addons (provided they can do >> unsafe things) they have lost already. >> >> > True. We do not make standards solely to protect inexp

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Dennis Joachimsthaler
Am 02.08.2011, 13:12 Uhr, schrieb Anne van Kesteren If users cannot trust their userscripts and addons (provided they can do unsafe things) they have lost already. True. We do not make standards solely to protect inexperienced users. Thank you for your insight on this matter, though.

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Anne van Kesteren
On Tue, 02 Aug 2011 13:05:07 +0200, Dennis Joachimsthaler wrote: It is not possible anyway? That kind of renders my worries baseless. Right. But this use case still holds: Userscripts and addons could still read out everything from the sites. It might be way too much a niche case though.

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Dennis Joachimsthaler
Am 02.08.2011, 13:00 Uhr, schrieb Anne van Kesteren : On Tue, 02 Aug 2011 12:48:06 +0200, Dennis Joachimsthaler wrote: Say, there's a site which uses an autologin facility to automatically log their users in when the site is opened. Malicious guy #1 prepares a site that loads the same site i

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Anne van Kesteren
On Tue, 02 Aug 2011 12:48:06 +0200, Dennis Joachimsthaler wrote: I agree that just disallowing that the page gets shown is one solution but I am mainly concerned about reading important information out of an iframe site. Say, there's a site which uses an autologin facility to automatically log

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Dennis Joachimsthaler
Am 02.08.2011, 12:38 Uhr, schrieb Anne van Kesteren : On Tue, 02 Aug 2011 12:33:18 +0200, Dennis Joachimsthaler wrote: I took a look at the X-Frame-Options and it only disallows displaying in a frame, not forbidding only script access. What kind of script access is allowed cross-origin that

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Anne van Kesteren
On Tue, 02 Aug 2011 12:33:18 +0200, Dennis Joachimsthaler wrote: I took a look at the X-Frame-Options and it only disallows displaying in a frame, not forbidding only script access. What kind of script access is allowed cross-origin that you are concerned about? -- Anne van Kesteren http

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Dennis Joachimsthaler
Hello Anne, I took a look at the X-Frame-Options and it only disallows displaying in a frame, not forbidding only script access. Also this is another case of a HTTP header that would also find a good place in the HTML itself, like with the Content-Disposition attribute I suggested (and now got s

Re: [whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Anne van Kesteren
On Tue, 02 Aug 2011 12:21:31 +0200, Dennis Joachimsthaler wrote: [...] The X-Frame-Options header addresses this if I understand the concern correctly. -- Anne van Kesteren http://annevankesteren.nl/

[whatwg] Prevent a document from being manipulated by a "top" document

2011-08-02 Thread Dennis Joachimsthaler
I think this needs a better thread title... Feel free to change it. I've been having this idea. Usually when you insert an , for example you can easily manipulate it's DOM structure. There is no way to prevent this, or? The top document can even just sandbox the iframe and allow scripts, but