Re: Seamless iframes + CSS3 selectors = bad idea

collin. this attack allows you to steal nonces, making csrf protections less
efficient. seamless iframes make this work on ALL the domain/origin..

greetings.

On Dec 6, 2009 2:05 AM, "Collin Jackson" <w3c@collinjackson.com> wrote:

A few thoughts:

* The password stealing attack can already be accomplished using the
iframe to create a login page and prompting the user to type their
password. It's not necessary to use CSS3 or seamless.
* If the password manager is used, CSS3 + seamless lets you steal the
password without user interaction.
* However, if you can inject arbitrary CSS3 and a seamless iframe into
a page, there's a good chance you can inject a password field, so this
password manager attack doesn't require seamless, just CSS3.
* Many webapps include a CSRF token in every page as a hidden form
field. If the page that allows CSS3 injection includes such a token,
you don't need seamless iframes to steal the token.

It seems like CSS3 is adding a lot of attack surface, sites may need
to block arbitrary CSS3 injection regardless of seamless. That is
unfortunate since browser vendors have been removing expression,
-moz-binding, and other features that make CSS injection dangerous.

On Sat, Dec 5, 2009 at 8:54 AM, Adam Barth <w3c@adambarth.com> wrote: > I
see.  The issue is that t...