<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 19, 2014, at 11:48 AM, Sean McArthur <<a href="mailto:smcarthur@mozilla.com">smcarthur@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jun 19, 2014 at 11:46 AM, Chris Karlof <span dir="ltr"><<a href="mailto:ckarlof@mozilla.com" target="_blank">ckarlof@mozilla.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><br></div><div><div>Ryan, we can keep framed content secure from the rest of the page. </div>
<div class=""><br></div></div></div></blockquote></div><br></div><div class="gmail_extra">An attack that is enabled by having our auth in an iframe: A malicious site can position an invisible form over the iframe, and capture the keypress events for the password.<br>
</div><div class="gmail_extra"><br></div></div>
</blockquote></div><br><div>yeah, we'd have to worry about clickjacking attacks.</div></body></html>