It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to protect.
Thus, the FrameBusting scripts came about, typically a simple script that runs as the site is loading; if its in a frame it reloads itself without frames.
Usually something simple along these lines:
if (top != self) top.location.replace(location);
Now, if you're on a public site, such as forum, or social networking site, where it is common to post links, and have them displayed in a frame, you might want to framebust your site (if you have anything sensitive there, are have users login, etc), out of the social networking's frames. But you also don't want to disrupt the user's experience, and cause them to think the site they're being linked to is suspicious... So you might be tempted to give them a popup to inform them whats going on - but that might just scare them even more....
So - which do you think would be the OVERALL best solution, considering the entirety of context, risks, and consequences, and avoiding "security theater"?
- Leave the site inside a frame
- Framebust silently
- Provide a popup, just to notify the user what is going on
- Provide a popup to the user with the option to cancel
P.S. The site was THIS site, and I found this out when posting the site to numerous security-related groups on LinkedIn after the public beta started (why dont you? ;) ), having received soem negative responses... Turns out, SE goes for option 3 - popup with no option to cancel. Crossposted as a bug to meta....