5 ms·
It didn't work! Score another point for NoScript. :-) I tried Chrome and still use it for certain things, but I refuse to use it as my primary browser until
by gvb 16y ago
It didn't work! Score another point for NoScript. :-)
I tried Chrome and still use it for certain things, but I refuse to use it as my primary browser until it has NoScript or equivalent.
- gphil 16y agoI'm using Chrome 5.0.375.38 on Mac OS X and the site didn't work for me either and I'm not running any kind of "NoScript" style extensions, just an out of the box Chrome.
- thorax 16y agoChrome 5.0.375.29 beta on Win7 and it worked fine here, sans favicon
- dkokelley 16y agoChrome 5.0.375.55 on Win 7 and I got the same thing. Site changed, but no favicon.
- sabat 16y ago5.0.375.55 beta on the mac here, and it worked.
- deleted 16y ago[deleted]
- jedbrown 16y agoDid not work for me, extension-free Chrome 6.0.401.1 on Linux.
- ComputerGuru 16y agoChrome 6.0.408.1 dev on Mac OS X 10.6.3 and it worked.
- InclinedPlane 16y agoI use Chrome and I have an "application shortcut" for gmail. On win7 gmail is its own separate icon on the taskbar, so this sort of attack wouldn't work on me at all.
- dkokelley 16y agoMaybe not for Gmail. What about your bank? Or Facebook?
- stanleydrew 16y agoBut chrome has basic noscript functionality built in. At least in the dev and beta channels.
- rodion_89 16y agoits been built-in for quite a while now actually..
- stanleydrew 16y agoYes, I've used it for quite some time. But I use the dev channel and have no idea what features are in the stable build at this point.
- gvb 16y agoThank you, I obviously had not checked in a while. Time to give Chrome another run as my New Favorite Browser. [edit] The "no javascript" control is under "Options / Under the Hood" click the "Content Settings" button. I see the ability to disable javascript and add exceptions. Javascript can be enabled by clicking on the icon at the right-hand side of the address bar. Cool!
- sesqu 16y agoIt only has the whitelisting functionality. I kept my noscript on allow-2nd-party, which unfortunately isn't offered in chrome.
- stanleydrew 16y agoTrue. The Chrome team accepts feature requests though. It couldn't hurt to ask.
- apphacker 16y agoPretty horrible interface though. Can't just right click on an open site to toggle block/allow.
- spokey 16y agoAlso didn't work for me (Firefox on Linux. I am not using NoScript). Clever idea. Has the demo worked for anyone? (Edit: I see below that posters report that this worked for at least some versions of Chrome on Windows)
- jim_dot 16y agoWorks in Safari on MacOS X
- lallysingh 16y agoFirefox w/o NoScript.
- azim 16y agoWorks for me in Firefox 3.59 on OpenSuse 11.2. OpenSuse for some reason also seems to have more compatibility with my workplace's web-based internal tools than other coworkers running Ubuntu or Fedora.
- deleted 16y ago[deleted]
- LeChuck 16y agoIt did work for met but the tabs don't match. http://i.imgur.com/qcQS1.png http://i.imgur.com/qcQS1.png
- tlrobinson 16y agoDon't be so sure NoScript will save you. You might be able perform the same attack using hanging HTTP requests to load a stylesheet and favicon at the bottom of the page. Defer completion of the requests for several minutes until it's likely the user has moved on to another tab. Stylesheet displays the hidden phishing UI, favicon is loaded. Bam, same effect. Alternatively use a meta refresh tag to simply redirect to an entirely different page.
- ErrantX 16y ago> Alternatively use a meta refresh tag to simply redirect to an entirely different page. That was going to be my suggestion too. In fact that would be my preferred attack because you could change the URL to something that looked "kosher" as well.