<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
The major criticism of earlier versions of Facebook Connect was that it
used an inline iframe for the user to enter their email/password if
they were not already signed into FB. While the inline iframe was
certainly less disruptive than the redirect that it replaced, users
could not tell where the password was being submitted. In addition to
being vulnerable to spoofing, the iframe was also vulnerable to
clickjacking. The current implementation of Connect uses a small popup,
with the address bar displayed, which for all intents and purposes is
equivalent to the redirect from a security perspective, but is much
less disruptive than the redirect.<br>
<br>
Allen<br>
<br>
Eddy Nigg (StartCom Ltd.) wrote:
<blockquote cite="mid:49C4A26F.6020803@startcom.org" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
On 03/21/2009 04:13 AM, Breno de Medeiros:
<blockquote
cite="mid:29fb00360903201913s1d9e78f4t6069ef195487d9c9@mail.gmail.com"
type="cite">It is interesting how a discussion on a relatively simple
extension proposal which was motivated by:<br>
<br>
1. Users saying in usability study after usability study that they are
more comfortable with the Facebook-Connect style login flow than the
full browser redirect model.<br>
</blockquote>
<br>
And wasn't Facebook criticized for it? Didn't many see a problem with
their approach? I don't think there is anything new with what was said.
Popup windows are generally on the decline when compared to 5 or 10
years ago, why start to use them now?<br>
<br>
</blockquote>
<br>
</body>
</html>