Browsers are not supposed to let javascript access the DOM or events in a cross-... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		ams6110 on July 11, 2017 \| parent \| context \| favorite \| on: Google bans its ads on sites that use annoying ‘po... Browsers are not supposed to let javascript access the DOM or events in a cross-domain iframe, is that not correct?

cpdt on July 12, 2017 [–]

Correct, but it's still possible for the parent page to overlay invisible textboxes and buttons in order to capture input.

chongli on July 12, 2017 | [–]

Wow, what a tire fire the web has turned out to be.

Can we just throw the whole thing out and start over? I miss the 90s...

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact