5

Shortly after the IT Security SE site went into public beta, I posted a link to it, on several security-focused groups on LinkedIn.
In one of them, I received a negative response (though I'm not sure you'll be able to view it if you're not in the group) that really got me thinking...

When SE site first loads, it checks if its loading inside a frame on another site, and if so, it reloads itself as the top level page. When posting links in LinkedIn, it in fact opens it in a frame, with a top header-frame showing that you're still in LI...

The problem here was that SE, in trying to be a good citizen and not surprise its users, displayed a popup, alerting the user that the site will be re-displayed without frames for security reasons. While it's completely understood why framebusting is necessary, and of course I think the popup is probably a good idea, here's the problem...

There was no way to cancel the reloading.
The fellow who responded apparently freaked out a bit, from this dodgy javascript alert that wants to do stuff to him for security reasons (heh, sounds like AIT...), and since he's security conscious (if not an expert in javascript security - obviously his approval was not needed to do the bad stuff...), REFUSED to click OK, even though that was his only option.
So, he wound up doing a hard restart (and providing some bad publicity to the site).

Problem 1: Scary popup with no option to cancel.
Problem 2: Is this scary popup really necessary?

I also asked this question in a different direction, to try to garner some more discussion...

For the record, here is the main part of my response to him there:

There are two things you should consider, however:
1. Removing frames IS recommended for any site that wants to be even remotely secure and isolated from other sites, there are many attacks based on framing the targeted website. In fact, your outrage should be directed at LinkedIn, for constantly framing everything! But then, links here are typically static, and NOT to such secure sites.
2. If the website wanted to run some "malicious" javascript, they really would not have to ask you for permission first. Accepting the popup, as annoying as it was, would not have ALLOWED them to run the script, it could have happened anyway.

Either way, I think you are correct that this popup is not as it should be. I think their thinking was that they shouldnt "surprise" the user by changing his expected experience, or by redirecting without the user's acknowledgment. At the very least, I agree that there should have been an option to cancel the scary popup... I will try to submit this to the devs to fix the UI issue.
For the record, StackExchange is a very wellknown and TRUSTED brand, and hundreds of thousands developers worldwide use StackOverflow.com often. Also the content is NOT generated by the developers themselves of course, but by us, the community. That is it's strength.

Improve this question
10
  • 6
    Personally I can not stand and will not use sites that mess with my link following semantics. That explicitly includes opening other sites in a frame in order to keep some kind of damn fool tool bar on. Maybe that makes me a grumpy old fart, but that's how it is. Any way, I couldn't care less if it bothers them. ::puts on Nelson Muntz voice and points:: Haw Haw!
    – dmckee --- ex-moderator kitten
    Nov 21 '10 at 5:41
  • 1
    @dmckee, I kinda agree with you - I find that aspect of linkedin bothersome and quite a bit dodgy, and mentioned this in my response to him. However, the lack of cancel option IS a bug as I see it, a UI bug that leads (kinda) to a security bug (as the perception of security is harmed here).
    – Reinstate Monica
    Nov 21 '10 at 6:30
  • @Jon Seigel, I didnt rollback because your change was good, but I put the tag back to "bug". As I said in my previous comment, the lack of cancel option IS a bug as I see it, a UI bug that leads (kinda) to a security bug (as the perception of security is harmed here).
    – Reinstate Monica
    Nov 21 '10 at 16:13
  • As an aside: SOFU no longer breaks out of Google cache results, but that's probably because Google no longer uses frames for that? Might be even worse then?
    – Arjan
    Nov 21 '10 at 16:45
  • 1
    The option to decline might be nice, but not to keep an expert in javascript security from doing a hard restart. I really think that response is over the top, for if there were no alert, the script would have executed without any warning whatsoever? And after clicking Cancel, the script could just do anything it likes too? But indeed: maybe some framing gives some visitors additional options they favour over better security?
    – Arjan
    Nov 21 '10 at 16:53
  • (Indeed: LinkedIn tells me Sorry you are not a member of the group you are trying to access.)
    – Arjan
    Nov 21 '10 at 17:03
  • 1
    @Arjan: he claimed to be an security expert, I said he's not expert in javascript - in fact my quoted response I said pretty much the same thing. The problem isnt actual security reduction, its reduction of security perception - which is sometimes almost as important, especially if we're talking about the reputation of the IT Security SE site... Again, doesnt matter if he's right or wrong, what matters here is that it looks bad.
    – Reinstate Monica
    Nov 21 '10 at 17:09
  • 1
    Just to be sure: I agree. On the other hand: if this dialog keeps the fake experts away, then that might be nice? ;-) (Get more popups like that! I'm no expert either, see if you can scare me away!)
    – Arjan
    Nov 21 '10 at 17:22
  • 3
    Do these security experts on LinkedIn also download the antivirus programs recommended in popups?
    – random
    Nov 21 '10 at 19:44
  • @random, thats quite amusing. @Arjan, he might be (probably is) an expert in a completely different field, such as risk management (we could use more of those), and not have a clue about javascript. I did mention elsewhere (on our meta) the problem of mixing such different fields...
    – Reinstate Monica
    Nov 22 '10 at 5:17
6

We can't allow declining this alert, ironically, because that would lead to a possible security issue. (also, why didn't this person simply terminate the browser process? rebooting seems extreme..)

That is, another script could override ours and allow framing, overwriting our UI in a frame ala this Twitter exploit:

http://shiflett.org/blog/2009/feb/twitter-dont-click-exploit

Basically, see here:

Frame Buster Buster ... buster code needed

it looks like X-Frame-Options: deny will now work, but only for very modern browsers http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx

Improve this answer
6
  • Nice! Just repeating a comment, in case you didn't know and want it fixed: SOFU no longer breaks out of Google cache results, probably because Google no longer uses frames for that.
    – Arjan
    Nov 21 '10 at 18:22
  • 1
    Interesting... I admit it's been a while since I messed around with framebusterbusterbusterbusters... You're saying, if you have a cancel button, someone else can clickjack that into being clicked, thus always cancelling your framebusting? Hmm...
    – Reinstate Monica
    Nov 22 '10 at 5:26
  • I definitely prefer the X-Frame-Options, but as you said it wont take for all common browsers yet. Cmon, doncha have some creative solution for this? It does look bad on LinkedIn... For example, over on SecuritySE, someone suggested a whitelist of allowed sites... Would it really be risky to be framed by LI?
    – Reinstate Monica
    Nov 22 '10 at 5:28
  • 2
    @avid no, without the alert taking action, a malicious javascript frame could always run. The de-framing alert HAS to be non-blockable and always de-frame immediately. Try investigating it yourself if you don't believe me..
    – Jeff Atwood
    Nov 22 '10 at 20:55
  • 5
    So then why haven't you started using the X-Frame-Options: deny header?
    – Rook
    Nov 27 '11 at 20:45
  • Why am I always getting this alert whenever Safari simply restores a tab that contains a SE site? I keep a tab open with Stack Overflow and whenever I start Safari, I get the frame-buster alert on the SO tab. It really seems like in this case, it should not be happening since no frames are ever involved.
    – Sparky
    Nov 12 '18 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .