5 ms·
Slow JS might be annoying but it's not particularly concerning , what is troublesome is the communication facilities of JS. I'd allow it by default if it had to
by anotherhue 13y ago
Slow JS might be annoying but it's not particularly concerning , what is troublesome is the communication facilities of JS. I'd allow it by default if it had to request permission to phone home.
Typical worrisome cases are when a malicious script scrapes credential forms or the tracking of mouse cursor movements / page scrolling for advertising analytics.
Essentially, I'll tolerate the web server having logs of my access to the page, but what I do once I've rendered the page should be my own business.
- acdha 13y ago> Typical worrisome cases are when a malicious script scrapes credential forms or the tracking of mouse cursor movements / page scrolling for advertising analytics. You do realize that the only way JavaScript runs on a page is for the remote site to choose to include it, right? If you don't trust their JavaScript why would you ever put sensitive information in a form and submit it anyway?
- anotherhue 13y agoIf we ignore any JS inserted by an attacker that has MITM abilities, then yes, but consider the innocuous case of someone typing in a form field and then changing their mind about what to say. The capabilities of this company in particular might motivate a few readers: http://www.clicktale.com/products/mouse-tracking-suite/visitor-recordings http://www.clicktale.com/products/mouse-tracking-suite/visit...
- acdha 13y agoIf they can MITM you, you're already at risk in so many ways that trying to worry about the vanishingly small percentage of times where someone enters text without submitting it is just wasting time you should be using to setup HTTPS.