19 ms·

>c2.org >This site requires JavaScript and Cookies to be enabled. Executing JavaScript from insecure http is a bad idea.[1] Especially for developers/IT admins

by danjoc 10y ago

>c2.org >This site requires JavaScript and Cookies to be enabled. Executing JavaScript from insecure http is a bad idea.[1] Especially for developers/IT admins who are targets of state sponsored hacking.[2] >Please change your browser settings or upgrade your browser. How about, no? There's a reason I block JS with noscript. It's not about page load speed, browser responsiveness, or ad blocking. (Although it helps in those areas remarkably) I block JS because executing untrusted JS code[3] is a good way to get hacked. [1]http://www.metafilter.com/130629/Possible-FBI-infiltration-of-TOR http://www.metafilter.com/130629/Possible-FBI-infiltration-o... [2]http://www.infoworld.com/article/2609621/hacking/uk-spy-agency-uses-nsa-attack-to-hack-slashdot--linkedin-users.html http://www.infoworld.com/article/2609621/hacking/uk-spy-agen... [3]https://mazinahmed.net/uploads/Bypassing%20NoScript%20Security%20Suite%20Using%20Cross-Site%20Scripting%20and%20MITM%20Attacks.pdf https://mazinahmed.net/uploads/Bypassing%20NoScript%20Securi...

cjhanks 10y ago
That is very helpful information. I am surprised it had JS, I would have to read why. Cookies are still harmful if no JS?
- danjoc 10y ago
  I consider cookies much more secure than the alternatives. Here's a detailed explanation as it relates to JWT. The main takeaway is, if properly configured by the site, cookies are more secure than alternatives like web storage. https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage https://stormpath.com/blog/where-to-store-your-jwts-cookies-... But that's coming from a site admin point of view. As a user, it would be great to have a browser plugin that allows me to reject cookies that aren't secure/httponly.