Pixel-perfect timing attacks with HTML5
The paper describes how to prevent the sniffing attack:Website owners can protect themselves from the pixel reading attacks described in this 
paper by disallowing framing of their sites. This can be done by setting the following HTTP 
header:X-Frame-Options: DenyThis header is primarily intended to prevent clickjacking attacks, but it is effective at 
mitigating any attack technique that involves a malicious site loading a victim site in an 
iframe. Any website that allows users to log in, or handles sensitive data should have this 
header set.I wonder, why is this option an opt-out and not an opt-in? Shouldn't this be the default?