<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On May 19, 2010, at 8:14 PM, Collin Jackson wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div class="gmail_quote">On Wed, May 19, 2010 at 4:57 PM, Adam Barth <span dir="ltr"><<a href="mailto:w3c@adambarth.com">w3c@adambarth.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Virtually none of the JavaScript framebusting scripts used by web<br>
sites are effective.</blockquote><div><br></div>Yes. If anyone would like to see more evidence of this, here's a recent study of the Alexa Top 500 web sites. None of them were framebusting correctly with JavaScript.</div>
<div class="gmail_quote"><span class="Apple-style-span" style="font-family: Verdana, sans-serif; -webkit-border-horizontal-spacing: 1px; -webkit-border-vertical-spacing: 1px; "><pre class="bz_comment_text" id="comment_text_74" style="font-size: medium; font-family: monospace; white-space: pre-wrap; width: 50em; ">
<a href="http://w2spconf.com/2010/papers/p27.pdf" style="color: rgb(0, 51, 153); ">http://w2spconf.com/2010/papers/p27.pdf</a></pre></span></div></blockquote></div>This probably is not the right list for this but seems like the X-FRAME-OPTIONS http header could be strengthened by having the UA send all requests from pages that have the X-FRAME-OPTIONS to also containt either the X-FRAME-OPTIONS or another tag. One weakness pointed out in the paper is that proxies can strip the header. If the server doesn't see the header come back, it would know that it got stripped out and the request needs to be questioned. I don't know if there is a way to introduced "fake" http headers into requests or not. If there is, that would need to be addressed too.<div><br></div><div>Perry</div><div><br></div></body></html>