Pixel-perfect timing attacks with HTML5
The paper describes how to prevent the sniffing attack:<p><i>Website owners can protect themselves from the pixel reading attacks described in this 
paper by disallowing framing of their sites. This can be done by setting the following HTTP 
header:<p>X-Frame-Options: Deny<p>This header is primarily intended to prevent clickjacking attacks, but it is effective at 
mitigating any attack technique that involves a malicious site loading a victim site in an 
iframe. Any website that allows users to log in, or handles sensitive data should have this 
header set.</i><p>I wonder, why is this option an opt-out and not an opt-in? Shouldn't this be the default?