28 votes
Accepted

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

See MDN: Crypto.getRandomValues(), where it reads: The Crypto.getRandomValues() method lets you get cryptographically strong random values. (emphasis mine) In contrast, see MDN: Math.random(), where ...
mti2935's user avatar
  • 23.4k
14 votes

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

Your friend is correct; always use Crypto.getRandomValues instead of Math.random for anything related to security. Math.random is designed for statistical simulations; and the numbers it produces ...
John Deters's user avatar
  • 34.2k
8 votes
Accepted

How to create a secure embeddable HTML form?

There's no really good way to do this. The problem is less clickjacking - though that is a risk - and more that the user has no way to know whether the frame is genuine, or a phishing site. Anybody ...
CBHacking's user avatar
  • 48.4k
6 votes
Accepted

X-Frame-Options Absent but cant load the page in iframe

The HTTP header Content-Security-Policy can be used to protect from loading the page in an iframe. In this case, its value is set to default-src 'self' *.xyz.com which means that only the current ...
Benoit Esnard's user avatar
5 votes
Accepted

Can malicious sites use session data from iframes?

No. A malicious site cannot interact with its iframes which point to other domains. It can only issue GET and POST requests without reading the corresponding responses, like any other web page opened ...
Enos D'Andrea's user avatar
4 votes

How to avoid the cross-frame scripting attack over core php we application

Cross-frame scripting allows an attacker to embed your website within their own, as a frame/iframe and then spy on the users of your website. This requires some social engineering. An attacker would ...
Jedi's user avatar
  • 3,976
2 votes

Is it okay to only provide clickjacking protection on the login page?

The answer is simple and straight-forward: Having clickjacking protection only on the login page only protects the login page. The rest of your site is still vulnerable It sounds like you have a ...
Conor Mancone's user avatar
1 vote

Can a javascript on parent page log keystrokes inside an iframe?

1)Yes 2) No (although plugins could in theory alter this behaviour, but I do not know of any myself) 3)Unless there is a vulnerability exploited in a browser that is yet to be patched, or the use of ...
ISMSDEV's user avatar
  • 3,270
1 vote

Loading a logged in page in an iframe

By default, yes, though the sandbox parameter in the iframe tag can change this behavior.
David's user avatar
  • 16.1k
1 vote

How to avoid the cross-frame scripting attack over core php we application

From this and this best place to get more info on issue @*Prevent Cross-Frame Scripting attacks*@ <script> (function (window) { if (window.location !== window.top.location) ...
Kurkula's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible