0

There are someways to stop click-jacking on websites without HTTPS, but I have seen that you cannot perform click-jacking on website the does have SSL. Is this true or can you still perform click-jacking?

closed as unclear what you're asking by Xander, Serge Ballesta, Steve, schroeder Apr 27 '17 at 6:38

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    What exactly makes you think that click-jacking on HTTPS is not possible, i.e. which part of click-jacking depends on having HTTP instead of HTTPS? In my opinion no part depends on it and click-jacking is still possible with HTTPS. – Steffen Ullrich Apr 26 '17 at 18:00
  • It not really perform-able on any site; way too many screen size combos these days. the days of 1024x768 IE6 being half the useragents are long over... – dandavis Apr 26 '17 at 21:15
  • @dandavis I don't think static 'screen size' is relevant ... – schroeder Apr 27 '17 at 6:38
  • @schroeder: Eve has to know where to place the invisible "transfer funds" button to get Alice to unwittingly click on it. we're talking about clickjacking, not just hidden links; it usually requires a GET payload injection and/or CSRF as well to queue up the important human-approved form button... – dandavis Apr 27 '17 at 7:01
  • @dandavis I think you're a little behind on the state of the art: medium.com/@Matt_S/… – schroeder Apr 27 '17 at 7:07
2

You should read about what SSL (HTTPS) really is. SSL has no connection to click-jacking, and it is still possible regardless. As dandavis stated in comments, proffesional pages nowadays are custom-scaled to browser resolution, so Click-Jacking is really not often used tactic. Modern websites also use headers to prevent click-jacking by telling browser not to load them in <frame> or <iframe> from other sites.

Not the answer you're looking for? Browse other questions tagged or ask your own question.