Google Not Reciprocating On IFrame Usage?

theodp writes "Over at the Google Web Search Community, posters are questioning why Google feels free to IFrame others' web pages, yet blocks attempts to IFrame pages on its own sites. 'Google has so much contradiction in what it wants for itself and what it does with other websites [e.g., Google frames Slashdot],' quipped one poster. 'Do no evil, right?' And over at the Google Maps Help Forum, developers are also begging for Google to allow them to IFrame entire pages again. 'I know there are other options (&embed etc.),' explains a poster, 'but then there is no sidebar which is useless. I really need the functionality like it was before.' Can any Googlers out there explain The Mystery of 'This content cannot be displayed in a frame'?"

XSRF

[Anonymous Coward]

It's to prevent XF clickjacking, XSS and XSRF attacks. Please see recent web security papers. Many other major sites with valuable login credentials do the same thing.

Clickjacking

[Anonymous Coward]

http://en.wikipedia.org/wiki/Clickjacking may be related.

Re:DRM for webpages

[rivetgeek]

Any person who modded this up needs a refresher in basic application security. The ability to iframe in a page allows for attacks like clickjacking.

Google is an advertising company, get over it!

[ad454]

Google is an advertising company. Nearly all of their sites and services are focused to drive ad revenue.

Please note: 2011-Q3: Total Ad Revenue $9.335B (96%), Other Revenue $0.385M (4%)
Source: Google Financial Results [google.com]

If Google did allow 3rd party frames of its websites, than that creates the situation that someone else can add their own advertising onto Google's pages/services, and prevents them from completing controlling the entire ad experience and ad revenue.

Personally I don't fault Google for this, since they are behaving exactly as one would expect from an advertising company. I think that other websites sites also need to use JavaScript and web tags to prevent Google using them in frames.