-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ringo Kamens wrote: > Ok, so as long as I don't whitelist anything, those attacks are pretty > much nullified right? not true: NoScript has a default whitelist with popular domains like google.com or yahoo.com
> What specifically gets disabled in TorButton when I turn on NoScript? nothing :) > Sorry about all the questions, this is all very confusing to me. let's try to clarify things a bit. + TorButton works on privacy: it enables the right proxy settings and provides some extra protections to prevent identity leaking. One of this feature is blocking of all javascript code to prevent injection by rogue exit nodes. + NoScript works on security (which is not privacy) it enforce a set of rules so that malicious sites or bad programmed one can't exploit some common information stealing tactics like cross site scripting or cross request forgery to gain illegal access to sites with your credentials. The core of all NoScript defenses is blocking javascript too. Those are the basic important concepts: the extensions works on two different things and their core functionality is the same, block all javascripts (then they do much more, but each of them in their context). Now, the problem: one of the feature of NoScript is selectively whitelisting sites so they can run javascripts or other possibly dangerous content (like flash objects). While this is a normal behaviour when browsing off-tor (as you usually trust your ISP but it can be exploited nevertheless) it becomes dangerous when browsing in-tor as TorButton will disable javascripts and NoScript will enable them if the site you are tor-browsing is whitelisted. I hope now it's a bit more clear :) However, I've still a question regarding this problem: Maone wrote to me saying that if someone or something globally disable javascripts, NoScript will honor it and it will not try to revert the behaviour. To me it looks like that if TorButton will switch the javascript.enabled options, both of the extensions could work fine together. I'd like to hear more from Perry about his work on this topic :-P And, as a final consideration, whitelisting only ssl-ed sites is a temporary workaround to be sure to have the functionality of both extensions without the questioned problem. HTH, ciao - -- Marco Bonetti Slackintosh Linux Project Developer: http://workaround.ch/ Linux-live for powerpc: http://workaround.ch/pub/rsync/mb/linux-live/ My webstuff: http://sidbox.homelinux.org/ My GnuPG key id: 0x86A91047 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFIqe/2yPKw+YapEEcRAqidAKCAxJZwO8TY0N5+TMfp1fLCRlryRQCfdPNa tv/JKC/R6jcZx/Mfh2/IR0M= =Y7Q/ -----END PGP SIGNATURE-----
