Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why not? Seems like this is only used for clickjacking, the solution should be simple enough.

share|improve this question
just because you can't think of a usecase except clickjacking does not mean that there are none. – Baarn Jan 29 '12 at 21:05
Transparent elements are used a lot - generally to provide user functionality and smooth visual transitions. – Rory Alsop Jan 30 '12 at 11:00

Banning opacity on elements containing an iframe would have negative impact of user interfaces (eg no nice fade effects when iframes are in play), but would not block clickjacking attacks.

Even if transparent iframes were impossible, you could still achieve all the same attacks by using a 1x1 pixel iframe that followed the pointer. Positioning inside that pixel can be achieved by scrolling a doubly-nested iframe. The potential one pixel difference underneath the pointer at rest would almost certainly be undetectable to the user.

So, yes, a browser could block it and temporarily be protected against a common form of attack. But as soon as a significant number of users have browsers that do that, the attacker will just change implementation technique. This is an example of a ‘fix’ that only works by making someone else the low-hanging-fruit; once everyone starts doing it, it is no solution at all. Consequently it makes sense to implement for a browser extension that not many people use, but no sense for a popular browser.

share|improve this answer

Some plugins will do this, or warn you of when it is occurring. Check out NoScript.

share|improve this answer

FYI there are other ways to do clickjacking without iframe transparency, so it wouldn't help anyway.

  • putting a non-transparent element on top of an iframe and set some CSS to make it be transparent only to mouse events
  • change cursor style to something not very visible and putting a fake mouse that will be shown 200px to the left of the real one

Only way to prevent clickjacking is to alter the gui (random positioning of BUY button?) or create confirmation sequences for critical actions (eg. force people to use keyboard)

share|improve this answer
Is there even one legitimate use for custom cursor styles? – curiousguy Jul 24 '12 at 6:50
Well, yes... People want to indicate different interactions with cursors like pointer or help. The cursor I had in mind is crosshair - totally invisible for windows users without perfect eyesight (at least when I used windows last time, it mihgt have changed) – naugtur Jul 25 '12 at 11:03

Even if browsers disallow overlaying elements (over iframes) and figured out how to deal (when deny) with opacity. There are still clickjacking techniques which can workaround these rules, for example, iframe resized to 1×1 pixel size and then attacker adds as many such iframes as he need to draw custom graphics by using those iframes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.