Comments on: clickjane.css: A CSS User Style Sheet to Help Detect and Avoid Clickjacking Attacks http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/ The brutally honest, first-person account of Meitar Moscovitz's life. Fri, 12 Mar 2010 09:25:36 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: 50 New CSS Techniques For Your Next Web Design | Theme Center http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-184416 50 New CSS Techniques For Your Next Web Design | Theme Center Sun, 13 Dec 2009 07:45:53 +0000 http://maymay.net/blog/?p=847#comment-184416 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: 50 New CSS Techniques For Your Next Web Design « Photoshop.vn – Your Design Resource http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-164919 50 New CSS Techniques For Your Next Web Design « Photoshop.vn – Your Design Resource Mon, 24 Aug 2009 01:15:12 +0000 http://maymay.net/blog/?p=847#comment-164919 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: Web Desiging Company New York http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-164012 Web Desiging Company New York Thu, 20 Aug 2009 10:48:01 +0000 http://maymay.net/blog/?p=847#comment-164012 I’ll be implementing your solution. I’ll be implementing your solution.

]]> By: 50 New CSS Techniques For Your Next Web Design « ES Websoft http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-161530 50 New CSS Techniques For Your Next Web Design « ES Websoft Sat, 08 Aug 2009 06:44:38 +0000 http://maymay.net/blog/?p=847#comment-161530 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: A few CSS Techniques For Your Next Web Design – Security and Performance | Free Webmaster Resource & Seo articles http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-158652 A few CSS Techniques For Your Next Web Design – Security and Performance | Free Webmaster Resource & Seo articles Sun, 26 Jul 2009 17:18:35 +0000 http://maymay.net/blog/?p=847#comment-158652 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: Meitar http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-158385 Meitar Thu, 23 Jul 2009 19:35:12 +0000 http://maymay.net/blog/?p=847#comment-158385 Ivan, since clickjacking has gotten a bit more press, MySpace.com has implemented a simple JavaScript solution to redirect users who are viewing their site within a frame to the MySpace.com homepage. To see the demo, disable JavaScript in your browser (and if you're using No-Script with Firefox, temporarily disable that, too), and then try to view the demo again. Ivan, since clickjacking has gotten a bit more press, MySpace.com has implemented a simple JavaScript solution to redirect users who are viewing their site within a frame to the MySpace.com homepage. To see the demo, disable JavaScript in your browser (and if you’re using No-Script with Firefox, temporarily disable that, too), and then try to view the demo again.

]]> By: Ivan http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-158331 Ivan Thu, 23 Jul 2009 08:07:38 +0000 http://maymay.net/blog/?p=847#comment-158331 I wasn't aware of this type of sneaky attacks. I'll be implementing your solution. I noticed that when i tried to check your clickjacking demo I keep getting automatically redirected to Myspace.com - is this because I'm not logged in to Myspace.com? or is some type of security measure I have in my browser which is protecting me from this attack? I'm guessing is the first one but I'd like to get confirmation - without registering in mySpace. I'm using the latest version of Firefox that came out yesterday 3.0.12 thanks, Ivan I wasn’t aware of this type of sneaky attacks. I’ll be implementing your solution.

I noticed that when i tried to check your clickjacking demo I keep getting automatically redirected to Myspace.com – is this because I’m not logged in to Myspace.com? or is some type of security measure I have in my browser which is protecting me from this attack?

I’m guessing is the first one but I’d like to get confirmation – without registering in mySpace.

I’m using the latest version of Firefox that came out yesterday 3.0.12

thanks,

Ivan

]]> By: 50 New CSS Techniques For Your Next Web Design | Desinine http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-158328 50 New CSS Techniques For Your Next Web Design | Desinine Thu, 23 Jul 2009 07:50:44 +0000 http://maymay.net/blog/?p=847#comment-158328 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: 50 New CSS Techniques For Your Next Web Design - Programming Blog http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-158052 50 New CSS Techniques For Your Next Web Design - Programming Blog Mon, 20 Jul 2009 23:12:28 +0000 http://maymay.net/blog/?p=847#comment-158052 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: Meitar Moscovitz (maymaym) 's status on Monday, 20-Jul-09 20:25:18 UTC - Identi.ca http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-158042 Meitar Moscovitz (maymaym) 's status on Monday, 20-Jul-09 20:25:18 UTC - Identi.ca Mon, 20 Jul 2009 20:25:48 +0000 http://maymay.net/blog/?p=847#comment-158042 [...] http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clic... [...] [...] http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clic... [...]

]]> By: 50 New CSS Techniques For Your Next Web Design « Tech7.Net http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-157984 50 New CSS Techniques For Your Next Web Design « Tech7.Net Mon, 20 Jul 2009 11:23:12 +0000 http://maymay.net/blog/?p=847#comment-157984 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: 50 New CSS Techniques For Your Next Web Design | CSS | Smashing Magazine http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-157972 50 New CSS Techniques For Your Next Web Design | CSS | Smashing Magazine Mon, 20 Jul 2009 08:43:40 +0000 http://maymay.net/blog/?p=847#comment-157972 [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...] [...] post covers how to use clickjane.css to prevent clickjacking, a class of security vulnerabilities kind [...]

]]> By: Jon http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-148352 Jon Mon, 06 Apr 2009 15:43:54 +0000 http://maymay.net/blog/?p=847#comment-148352 I am getting really fed up of spyware and stuff like viruses. There doesn't seem to be a regulatory body that can find these people and prosecute them for the waste of man-years. The site I link to is a good starter for free internet security to defend yourself with. Basically - Firefox, a free virus checker, Spybot and Spywareblaster coupled with a good firewall policy will stop most rubbish before you notice it on your machine. Stopping attacks on a website is where I would need help. I am getting really fed up of spyware and stuff like viruses. There doesn’t seem to be a regulatory body that can find these people and prosecute them for the waste of man-years. The site I link to is a good starter for free internet security to defend yourself with. Basically – Firefox, a free virus checker, Spybot and Spywareblaster coupled with a good firewall policy will stop most rubbish before you notice it on your machine. Stopping attacks on a website is where I would need help.

]]> By: Max Design - standards based web design, development and training » Some links for light reading (17/2/09) http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-143202 Max Design - standards based web design, development and training » Some links for light reading (17/2/09) Tue, 17 Feb 2009 08:00:21 +0000 http://maymay.net/blog/?p=847#comment-143202 [...] Clickjane.css: A CSS User Style Sheet to Help Detect and Avoid Clickjacking [...] [...] Clickjane.css: A CSS User Style Sheet to Help Detect and Avoid Clickjacking [...]

]]> By: Meitar http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-139925 Meitar Tue, 30 Dec 2008 03:40:30 +0000 http://maymay.net/blog/?p=847#comment-139925 To be clear, clickjacking is a very different attack from key logging. Also, on principle, a compromised system can't be ultimately trusted regardless of what other software is running, NoScript or GuardedID not excepted. Again, this is where a difference between clickjacking—which is constrained within the browser or in a particular user interface—differs from things like malware or software viruses. To be clear, clickjacking is a very different attack from key logging. Also, on principle, a compromised system can’t be ultimately trusted regardless of what other software is running, NoScript or GuardedID not excepted. Again, this is where a difference between clickjacking—which is constrained within the browser or in a particular user interface—differs from things like malware or software viruses.

]]> By: brenda http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-139909 brenda Mon, 29 Dec 2008 18:06:39 +0000 http://maymay.net/blog/?p=847#comment-139909 Just caught this article and though I would respond. GuardedID is a great product. I've been using it for over a year. I was so impressed with the fact they jumped right on "clickjacking" threat and have protection by way of an ALERT. If you see a white opaque box with a red dotted line around it and the white opacity doesn't disappear, this is your warning the area may contain embedded malicious code which we know as "clickjacking" now. So I know NEVER to click on the area for fear it could be a fake website too. I'm super paranoid about identity theft because it happened to me 12 years ago and it took from then until March of 2008 (thanks to new laws) for me to stop getting harrassed by collection agencies and to get fraud charges off my credit report. This has been a HORRIBLE experience plagung me for YEARS! I got GuardedID to provide keystroke encryption which eased my paranoia of doing anything online. THEN with the latest release that came out a few weeks ago, I saw they added another cool feature... letting you know if you have a keylogger installed on your system! Low and behhold when I upgraded, I instantly got a keyboard driver WARNING! Even told me what the driver in question was. Scared the c--- out of me. Still have to take my computer in to have my technician check out this driver warning. I'm not worried because anything I type when online is protected by GuardedID anyway. I just need to get my suspicious driver issue taken care of. GuardedID is THE best tool for keyboard protection. If I'm correct, it's also patent-pending and the keylogger warning is AWESOME! EVERYONE should have this! It works on IE and Firefox too. Just caught this article and though I would respond.

GuardedID is a great product. I’ve been using it for over a year. I was so impressed with the fact they jumped right on “clickjacking” threat and have protection by way of an ALERT. If you see a white opaque box with a red dotted line around it and the white opacity doesn’t disappear, this is your warning the area may contain embedded malicious code which we know as “clickjacking” now. So I know NEVER to click on the area for fear it could be a fake website too.

I’m super paranoid about identity theft because it happened to me 12 years ago and it took from then until March of 2008 (thanks to new laws) for me to stop getting harrassed by collection agencies and to get fraud charges off my credit report. This has been a HORRIBLE experience plagung me for YEARS!

I got GuardedID to provide keystroke encryption which eased my paranoia of doing anything online. THEN with the latest release that came out a few weeks ago, I saw they added another cool feature… letting you know if you have a keylogger installed on your system! Low and behhold when I upgraded, I instantly got a keyboard driver WARNING! Even told me what the driver in question was. Scared the c— out of me. Still have to take my computer in to have my technician check out this driver warning.

I’m not worried because anything I type when online is protected by GuardedID anyway. I just need to get my suspicious driver issue taken care of.

GuardedID is THE best tool for keyboard protection. If I’m correct, it’s also patent-pending and the keylogger warning is AWESOME!

EVERYONE should have this! It works on IE and Firefox too.

]]> By: Meitar http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-139900 Meitar Mon, 29 Dec 2008 14:18:56 +0000 http://maymay.net/blog/?p=847#comment-139900 I've only researched NoScript's handling of clickjacking protection, as I use Firefox and very rarely use Internet Explorer for anything other than compatibility checks while developing. It was <a href="http://en.wikipedia.org/wiki/Clickjacking" rel="nofollow">the Wikipedia article on clickjacking</a> where I learned about GuardedID. It reads: <blockquote cite="http://en.wikipedia.org/wiki/Clickjacking">Protection against clickjacking is provided for Internet Explorer by GuardedID.</blockquote> which is everything that I know about it. :) If I'm to hazard a guess, though, I'd imagine it's not dissimilar from <a href="http://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/" rel="nofollow">NoScript's behavior</a>, which (as I'm sure you know) brings up a dialogue when you click on a partially visually obscured element. I’ve only researched NoScript’s handling of clickjacking protection, as I use Firefox and very rarely use Internet Explorer for anything other than compatibility checks while developing. It was the Wikipedia article on clickjacking where I learned about GuardedID. It reads:

Protection against clickjacking is provided for Internet Explorer by GuardedID.

which is everything that I know about it. :) If I’m to hazard a guess, though, I’d imagine it’s not dissimilar from NoScript’s behavior, which (as I’m sure you know) brings up a dialogue when you click on a partially visually obscured element.

]]> By: Giorgio Maone http://maymay.net/blog/2008/12/29/clickjanecss-a-css-user-style-sheet-to-help-detect-and-avoid-clickjacking-attacks/comment-page-1/#comment-139898 Giorgio Maone Mon, 29 Dec 2008 13:55:03 +0000 http://maymay.net/blog/?p=847#comment-139898 May I ask you how this "GuardedID" product is supposed to mitigate Clickjacking, exactly, and where did you took this info? May I ask you how this “GuardedID” product is supposed to mitigate Clickjacking, exactly, and where did you took this info?

]]>