Hacker News Reader

That's not sufficient when the external page can be controlled and the iframe target set by it.

Agreed that in situation like this it's near impossible to ascertain that iframe target wasn't altered, unless you already somehow know what it was before you got mitmd.

Yeah, that’s a little better but can’t an attacker inject something in the surrounding the age that compromises the iframe? Or even rewrite the iframe to use a proxy under the attackers control?

Maybe the vendor improved since then (it's still not very secure as others and Chrome pointed out), but I remembered that back last Aug I searched for "https" in the source code and that's not the case.

Even now it doesn't inspire much confidence :)