3 ms·
I hope webrtc isn't authorized by default by browsers.I want to give explicit consent.It should even have been that way for ajax requests.
by aikah 12y ago
I hope webrtc isn't authorized by default by browsers.I want to give explicit consent.It should even have been that way for ajax requests.
- slang800 12y agoWhat makes AJAX requests dangerous?
- slg 12y agoSome people just want to know about any data their browser is sending server side. In the old days, your browser would not do anything without you making a conscious action. Widespread AJAX use changed that so your browser could be sending information to a server without any oversight. That lack of oversight isn't inherently dangerous, but certainly has potential for exploitation.
- eknkc 12y agoYou could always send information using javascript by loading images, hidden iframes etc. (You would not get a meaningful response though). This applies to dark old days even before JS..
- deleted 12y ago[deleted]
- hrjet 12y agoGreat point. Lately we have been reconsidering the request manager matrix shown in gngr. It was inspired by HTTPSwitchBoard's matrix, that has a separate column for XHR. However, like you pointed out, there are other ways than XHR to leak data if JS is enabled. If JS is not enabled, the kinds of data that can be leaked is fewer (perhaps screen resolution and size). Would welcome expert comments on our issue tracker: https://github.com/UprootLabs/gngr/issues/90 https://github.com/UprootLabs/gngr/issues/90
- ChrisAntaki 12y agoYou might be interested in NoScript. With this addon, JavaScript can be blocked by default, and allowed on pages of your choosing.