Is there something better/more intuitive than NoScript? #31
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
NoScript is trying, but it's still pretty obscure for most internet users. More importantly, in normal operation the more you actually use NoScript the more information sites can figure out about how you use NoScript. If I'm the attacker, what I do is gather a list of Javascript's from various sites. These sites fall into 2 categories, sites which I'm interested in learning about visitors to, and "control" sites which are sites I own, possibly inside of I2P, which exist solely to load scripts which NoScript then blocks. When you visit my site, I load all the Javascripts from my probe list, and set up some event to go off when each Javascript is loaded which communicates back with my server. I use the control sites to determine your likely baseline NoScript configuration, and anything that looks different(i.e. any scripts that you have un-blocked in NoScript) corresponds to a script from a site which you have visited. This is why Tor Browser hides NoScript and instead exposes "Coarse" settings which affect all pages and not just one page or set of scripts on an origin at a time, to avoid NoScript becoming a source of fingerprint granularity. For clearnet accesses, sites that make especially heavy use of CDN's are kind of just doing this by accident.
Perhaps a better approach is available via another Firefox plugin, which more closely emulates the three-tier coarse settings intended to reduce granularity?
Resolved on master.
Tentative plan is to enable this via a "Usability Mode" option which alters the Firefox extension loadout. #8
Jshelter's Network Boundary enforcement is somewhat appealing. We enforce network boundaries by other means, namely, we restrict the browser profile to interacting with only
http://localhost:7657and forcibly isolate requests that leave the network boundary. Jshelter would complement this by providing a notification whenever a service attempted to breach a network boundary.Yes, looks like it: https://jshelter.org/ first glance pros it doesn't break most sites, cons it's very new, like nobody's written the configuration docs yet.