4 ms·

Yet another reason to use NoScript. ... why would I be down-voted for mentioning a solution which prevents 100% of JavaScript history attacks???

axod 17y ago
It's not really relevant to anything. I could say it's another reason to go back to using BBS's instead of the WWW, but that's not really a useful observation is it.
- Kadin 17y ago
  I don't think disabling JS by default is equivalent to going back to BBSes. IMO it's how JS and other client-side scripting technologies should have been implemented from the very beginning, on an opt-in basis with the onus on the site developer to convince users that it's worthwhile to enable the feature for their site.
  - axod 17y ago
    That would be a terrible user experience. At one time browsers didn't display images by default eiter. It was horrible.
- jrockway 17y ago
  But that's not what noscript does; it allows you to whitelist known-good scripts, and only run those. So when you go goodsite.com, you can see the cool javascript animations, but when you browse to steals-your-history.com, your history won't be stolen. Sure, goodsite.com can choose to spy on you... but that is less likely than some other random site being the bad one.
  - mooncaine 17y ago
    "... but when you browse to steals-your-history.com, your history won't be stolen." Ah, but you won't know if your history's being stolen, right? The exploit can be hidden from the user's eyes, hidden in an ad, for example, that the site you trust shows you without realizing that ad is hacking your history. Phishing sites, too, of course. A big problem caused by this elegant hack is that it uses services web users can't easily do without, services that most browser users don't know about (and, ideally, shouldn't need to understand). I guess you're suggesting that a user must be more wary of websites, avoiding unknown ones. Is that what you're suggesting? It'll be interesting to see what can be tried to remedy the privacy issues caused by this.
lincolnq 17y ago
I use NoScript too, but you can do it in pure CSS and Noscript won't block it: just set a:visited for the link you're interested in to use a certain background image, which will only hit your server if the link is actually visited.

axod 17y ago

It's not really relevant to anything. I could say it's another reason to go back to using BBS's instead of the WWW, but that's not really a useful observation is it.

Kadin 17y ago
I don't think disabling JS by default is equivalent to going back to BBSes. IMO it's how JS and other client-side scripting technologies should have been implemented from the very beginning, on an opt-in basis with the onus on the site developer to convince users that it's worthwhile to enable the feature for their site.
- axod 17y ago
  That would be a terrible user experience. At one time browsers didn't display images by default eiter. It was horrible.
jrockway 17y ago
But that's not what noscript does; it allows you to whitelist known-good scripts, and only run those. So when you go goodsite.com, you can see the cool javascript animations, but when you browse to steals-your-history.com, your history won't be stolen. Sure, goodsite.com can choose to spy on you... but that is less likely than some other random site being the bad one.
- mooncaine 17y ago
  "... but when you browse to steals-your-history.com, your history won't be stolen." Ah, but you won't know if your history's being stolen, right? The exploit can be hidden from the user's eyes, hidden in an ad, for example, that the site you trust shows you without realizing that ad is hacking your history. Phishing sites, too, of course. A big problem caused by this elegant hack is that it uses services web users can't easily do without, services that most browser users don't know about (and, ideally, shouldn't need to understand). I guess you're suggesting that a user must be more wary of websites, avoiding unknown ones. Is that what you're suggesting? It'll be interesting to see what can be tried to remedy the privacy issues caused by this.

lincolnq 17y ago

I use NoScript too, but you can do it in pure CSS and Noscript won't block it: just set a:visited for the link you're interested in to use a certain background image, which will only hit your server if the link is actually visited.