[10302] in www-talk@info.cern.ch
Re: Extended URL for frames
daemon@ATHENA.MIT.EDU (David Perrell)
Fri Sep 13 08:18:31 1996
From: "David Perrell" <davidp@earthlink.net>
To: "Larry Masinter" <masinter@parc.xerox.com>
Cc: <www-talk@w3.org>
Date: Fri, 13 Sep 1996 05:15:08 -0700
Resent-From: www-talk@w3.org
Larry Masinter wrote:
> I it's ugly. I don't like it. Here are some reasons:
>
> I think there's a security risk:
>
> company A has some pages, with frames
> site X has some obnoxious pages
> hacker Y creates a funny link, that insert's some of
> X's pages into A's frame.
> user U clicks on Y's link, sees a URL that
> looks like it comes from company A but has
> X pages in the middle.
Nasty, yes, but security risk?
The URL need not look like it came from company A. The extended URL
could appear in the browsers location window, and the offending frames
would be seen to have content from another domain.
Many users pay little or no attention to the location window anyway.
hacker Y could create the same bad PR with a frameset at Y's location.
The idea is to be able to both bookmark and publish a frame state,
something some have expressed a desire for. However a frame state is
published will leave an opening for the kind of abuse you describe.
Anyway, a good point. Thanks for the comments.
David
