3 ms·
You just let the javascript send a heartbeat ping. If you don't receive the ping but served the page you can determine that the user agent did not execute the j
by slashink 6y ago
You just let the javascript send a heartbeat ping. If you don't receive the ping but served the page you can determine that the user agent did not execute the javascript.
- cortesoft 6y agoSure, but the comment mentions that you would use the 'set of websites that are whitelisted' as an identifier... your method can only check the site you are currently on, it doesn't give you information on if other websites have been whitelisted or not.
- flotzam 6y agoAFAIK NoScript whitelists don't respect first-party isolation (so a JS-enabled website can be included in a JS-disabled website), which makes it a relatively simple coordination problem between website A and B (possibly automated by a third-party tracker included in both A and B). In any case, first-party isolation can be subverted: https://news.ycombinator.com/item?id=17947605 https://news.ycombinator.com/item?id=17947605
- cortesoft 6y agoYes, with coordination it is possible. I was thinking of the non-coordination issue.