[joev_]

Unfortunately x-frame-options does not always fix these kinds of problems. If you can get the user to click more than once on your page, you can open a tab in the background on the first click (google for popunder.js), and if you can predict click #2 a split second before it happens (e.g. zalewski's game PoC), you can bring the popunder to the front and reposition it right under their cursor.

(note: amazon could fix this by detecting when opener is xdomain and requiring some minimum number of mouseover events in the page before the button is clickable).

[erikano]

>zalewski's game PoC

I googled this but found nothing relevant. Do you have a link?

[joev_]

http://lcamtuf.coredump.cx/clickit/

[erikano]

Thanks :)