41–50 of 53 posts
Earlier quoted context omitted.
But it would be very easy to forge any secure iframe address bar using JS/CSS.
The bar would be part of the user agent's iframe element, not accessible via JS/CSS. Sure, you could overlay an element on top of the bar with JS/CSS, and some thought would have to be put in to avoid that type of forgery.
This is a big security problem with iframes. I have hoped for years that developers of the major browsers should understand this and automatically change the adress bar to the iframes url when the iframe is having focus. Problem solved!
Not really problem solved so long as browsers continue to have cross frame scripting (XFS) issues. There are also issues surrounding which iframe to enumerate in the address bar. Finally, additional attacks would surely arise. Because the host domain still owns the DOM it could overwrite the region where the iframe is presented, knowing that the address bar would change to a trusted domain. In short I see this sort o…
Their is only solution today to verify if the iframe is legitimate or not and that is to include a link in the iframe that the user can click on (With the text: Is this a legitimate login form?). This links opens up a new browser tab and in that tab PayPal checks the referrer. If the referrer comes from PayPal (the iframe) we know that this iframe is not a fake one and can present that information to the user.
In cases like this, asking users for information, especially for payment details, for a different site than the user is visiting (e.g. PayPal) should be done using separate windows or iframes. Period. Additionally, the specification for visible iframes should make it clear to the user the iframe’s document URL. The iframe itself should have its own non-editable URL address bar, including an interactable area to allow…
The method PayPal is using right now, the one mentioned in the article, utilizes iframes. > The iframe itself should have its own non-editable URL address bar This would definitely be good for security, but I feel like it would probably be overkill for many other iframe use cases. Think about every YouTube embed having an address bar. And what about the "hidden" iframes that are only 1x1, do you still show an address…
The certificate verification UI in browsers only works because it's outside of the area that a website could display a fake one in. You'd need some kind of indicator tied to the iframe from outside the web view, otherwise they'll end up like the ads that looks like popup windows to trick you into clicking the close button.
If you're going to trust a website with your credit card you probably trust them enough to not try and steal your paypal information. There isn't a way to solve this issue without hurting the user experience. For some websites, that's a fair trade off. Maybe a browser could put in a "Verify iframes" button that would show you the payment form is actually coming from PayPal.
[1]: https://www.paypal.com/us/webapps/mpp/paypal-safety-and-secu... @ Who you are is how you pay
If you're going to trust a website with your credit card you probably trust them enough to not try and steal your paypal information. There isn't a way to solve this issue without hurting the user experience. For some websites, that's a fair trade off. Maybe a browser could put in a "Verify iframes" button that would show you the payment form is actually coming from PayPal.
Google Wallet for Digital Goods (which Google is retiring soon) does this, and I think it is the best payment user experience that has been made, so far.
This is a big security problem with iframes. I have hoped for years that developers of the major browsers should understand this and automatically change the adress bar to the iframes url when the iframe is having focus. Problem solved!
Did Paypal just remove the issue reporting page or is the link in the article just wrong? https://www.paypal.com/webapps/mpp/security/report-problem
Doesn't this weakness potentially exist with any integrated payment page on any site using any payment platform, though? There is always a level of trust involved with entering these kinds of credentials on-line. This is why some of the 3-D Secure systems make you (the customer) give them a greeting of your own choice to incorporate in the prompt for your confirmation code. However, it seems that for many vendors the…
Doesn't this weakness potentially exist with any integrated payment page on any site using any payment platform, though? There is always a level of trust involved with entering these kinds of credentials on-line. This is why some of the 3-D Secure systems make you (the customer) give them a greeting of your own choice to incorporate in the prompt for your confirmation code. However, it seems that for many vendors the…
If 3D is anything like the silly Verified by Visa, it's atrocious. Some strange domain that sounds like a generic phishing attempt. Random password with supposedly a secure phrase to indicate they know me... But anyone with my card details can look that up and show it for me. I see no value in such systems, and they must murder conversion rates.
The major advantage for merchants of using these schemes is that liability for various types of card fraud is shifted elsewhere, instead of the merchant getting dumped with the cost of fraudulent transactions even if they did nothing wrong except trust the payment services to do their job.
Much of this is likely to change again early next year, because there are SEPA-wide rules coming in that require strong authentication for Internet payments. Even the giant payment services can't ignore them, because liability for fraud on their networks is (finally) going to land on them whether they like it or not after the new rules take effect.
If you're going to trust a website with your credit card you probably trust them enough to not try and steal your paypal information. There isn't a way to solve this issue without hurting the user experience. For some websites, that's a fair trade off. Maybe a browser could put in a "Verify iframes" button that would show you the payment form is actually coming from PayPal.