31–40 of 53 posts
This sounds even scarier - the user should be in control and able to inspect the page without the page knowing, since as he mentions, the attacker could otherwise deploy countermeasures to evade.
This isn't a new thing, it's been possible for a number of years to integrate paypal using an iframe. Hands-up - I'm guilty of doing this. I hadn't really considered the issue before, but I agree it is a security concern. One of the reasons developers switch to using an iframe rather than a separate window is due to popup blocking. Retrieving the url for a payment system usually requires making a server side call, so…
>This isn't a new thing, it's been possible for a number of years to integrate paypal using an iframe. Yes, I know about classic integration options. But it's not about what was possible (any kind of phishing is always possible) it's about what Paypal suggests by default and what websites actually use. > Retrieving the url for a payment system usually requires making a server side call window.open('site.com/get-url-f…
But as long as the attacker can detect when the user opens devtools all your efforts are futile. This sounds even scarier - the user should be in control and able to inspect the page without the page knowing, since as he mentions, the attacker could otherwise deploy countermeasures to evade.
This is a big security problem with iframes. I have hoped for years that developers of the major browsers should understand this and automatically change the adress bar to the iframes url when the iframe is having focus. Problem solved!
There isn't a way to solve this issue without hurting the user experience. For some websites, that's a fair trade off.
Maybe a browser could put in a "Verify iframes" button that would show you the payment form is actually coming from PayPal.
Huh, this seems very obvious in hindsight. I guess with Stripe things are a bit easier since you have none of this username/password stuff to be dealing with (you could get your cc number swiped, but if you're an American you're dealing with that issue everyday anyways).
Exactly, giving your CC details to some website is a routine, but your email+password are critical credentials.
In cases like this, asking users for information, especially for payment details, for a different site than the user is visiting (e.g. PayPal) should be done using separate windows or iframes. Period. Additionally, the specification for visible iframes should make it clear to the user the iframe’s document URL. The iframe itself should have its own non-editable URL address bar, including an interactable area to allow…
Even if you require the iframe to have some specific styling and make it so the parent DOM cannot edit it, we're talking about spoofing.
With html, js, and css you can reproduce absolutely any iframe styling by simply not using an iframe and pretending you are.
If you were to put the iframe's true url in the location bar e.g. having url: https://github.com/fragement | selected: https://paypal.com/fragment then that could sovle the problem however.
Browsers cannot edit domains in the location bar so this could work, but your suggestion absolutely doesn't.
Furthermore, I don't think the idea I outline above is a good idea because it requires users to learn something more. I'd rather just have the "redirect to and redirect back when done" solution since people have already learned to check "am I on paypal, does my address bar say paypal, is my ssl cert thingy green" and relearning to check "is my selected url paypal even though I'm on github" is not something that would happen quick enough in my mind.