There are someways to stop click-jacking on websites without HTTPS, but I have seen that you cannot perform click-jacking on website the does have SSL. Is this true or can you still perform click-jacking?

  • 5
    What exactly makes you think that click-jacking on HTTPS is not possible, i.e. which part of click-jacking depends on having HTTP instead of HTTPS? In my opinion no part depends on it and click-jacking is still possible with HTTPS. – Steffen Ullrich Apr 26 '17 at 18:00
  • It not really perform-able on any site; way too many screen size combos these days. the days of 1024x768 IE6 being half the useragents are long over... – dandavis Apr 26 '17 at 21:15
  • @dandavis I don't think static 'screen size' is relevant ... – schroeder Apr 27 '17 at 6:38
  • @schroeder: Eve has to know where to place the invisible "transfer funds" button to get Alice to unwittingly click on it. we're talking about clickjacking, not just hidden links; it usually requires a GET payload injection and/or CSRF as well to queue up the important human-approved form button... – dandavis Apr 27 '17 at 7:01
  • @dandavis I think you're a little behind on the state of the art: medium.com/@Matt_S/… – schroeder Apr 27 '17 at 7:07

You should read about what SSL (HTTPS) really is. SSL has no connection to click-jacking, and it is still possible regardless. As dandavis stated in comments, proffesional pages nowadays are custom-scaled to browser resolution, so Click-Jacking is really not often used tactic. Modern websites also use headers to prevent click-jacking by telling browser not to load them in <frame> or <iframe> from other sites.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.