Hacker News Reader

Browsers are not supposed to let javascript access the DOM or events in a cross-domain iframe, is that not correct?

Correct, but it's still possible for the parent page to overlay invisible textboxes and buttons in order to capture input.

Wow, what a tire fire the web has turned out to be.

Can we just throw the whole thing out and start over? I miss the 90s...