said by swhx7:The discoverers have been vague about just what the "clickjacking" involves. The reason of course is the same as in the recent Kaminsky/DNS thing, to give vendors time to patch. This has led to some anxiety about how site maintainers and surfers can be safe.
In looking around however, I found a clear explanation of at least one implementation of it: »
lists.whatwg.org/pipermail/whatw···284.htmlThe above is already out there, so I'm not making it any worse by linking.
I favor Zalewski's #4, because it puts the user most in control.
Oleg, glad that you've started a dedicated thread for this.
