Shortly after the IT Security SE site went into public beta, I posted a link to it, on several security-focused groups on LinkedIn.
In one of them, I received a negative response (though I'm not sure you'll be able to view it if you're not in the group) that really got me thinking...
When SE site first loads, it checks if its loading inside a frame on another site, and if so, it reloads itself as the top level page. When posting links in LinkedIn, it in fact opens it in a frame, with a top header-frame showing that you're still in LI...
The problem here was that SE, in trying to be a good citizen and not surprise its users, displayed a popup, alerting the user that the site will be re-displayed without frames for security reasons. While it's completely understood why framebusting is necessary, and of course I think the popup is probably a good idea, here's the problem...
There was no way to cancel the reloading.
The fellow who responded apparently freaked out a bit, from this dodgy javascript alert that wants to do stuff to him for security reasons (heh, sounds like AIT...), and since he's security conscious (if not an expert in javascript security - obviously his approval was not needed to do the bad stuff...), REFUSED to click OK, even though that was his only option.
So, he wound up doing a hard restart (and providing some bad publicity to the site).
Problem 1: Scary popup with no option to cancel.
Problem 2: Is this scary popup really necessary?
I also asked this question in a different direction, to try to garner some more discussion...
For the record, here is the main part of my response to him there:
There are two things you should consider, however:
1. Removing frames IS recommended for any site that wants to be even remotely secure and isolated from other sites, there are many attacks based on framing the targeted website. In fact, your outrage should be directed at LinkedIn, for constantly framing everything! But then, links here are typically static, and NOT to such secure sites.
2. If the website wanted to run some "malicious" javascript, they really would not have to ask you for permission first. Accepting the popup, as annoying as it was, would not have ALLOWED them to run the script, it could have happened anyway.Either way, I think you are correct that this popup is not as it should be. I think their thinking was that they shouldnt "surprise" the user by changing his expected experience, or by redirecting without the user's acknowledgment. At the very least, I agree that there should have been an option to cancel the scary popup... I will try to submit this to the devs to fix the UI issue.
For the record, StackExchange is a very wellknown and TRUSTED brand, and hundreds of thousands developers worldwide use StackOverflow.com often. Also the content is NOT generated by the developers themselves of course, but by us, the community. That is it's strength.