Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?

Question

Why not? Seems like this is only used for clickjacking, the solution should be simple enough.

Answer 1

Banning opacity on elements containing an iframe would have negative impact of user interfaces (eg no nice fade effects when iframes are in play), but would not block clickjacking attacks.

Even if transparent iframes were impossible, you could still achieve all the same attacks by using a 1x1 pixel iframe that followed the pointer. Positioning inside that pixel can be achieved by scrolling a doubly-nested iframe. The potential one pixel difference underneath the pointer at rest would almost certainly be undetectable to the user.

So, yes, a browser could block it and temporarily be protected against a common form of attack. But as soon as a significant number of users have browsers that do that, the attacker will just change implementation technique. This is an example of a ‘fix’ that only works by making someone else the low-hanging-fruit; once everyone starts doing it, it is no solution at all. Consequently it makes sense to implement for a browser extension that not many people use, but no sense for a popular browser.

Answer 2

Some plugins will do this, or warn you of when it is occurring. Check out NoScript.

Answer 3

FYI there are other ways to do clickjacking without iframe transparency, so it wouldn't help anyway.

• putting a non-transparent element on top of an iframe and set some CSS to make it be transparent only to mouse events
• change cursor style to something not very visible and putting a fake mouse that will be shown 200px to the left of the real one

Only way to prevent clickjacking is to alter the gui (random positioning of BUY button?) or create confirmation sequences for critical actions (eg. force people to use keyboard)

Answer 4

Even if browsers disallow overlaying elements (over iframes) and figured out how to deal (when deny) with opacity. There are still clickjacking techniques which can workaround these rules, for example, iframe resized to 1×1 pixel size and then attacker adds as many such iframes as he need to draw custom graphics by using those iframes.