Comment by jgrahamc | Hacker News Reader

Comment by jgrahamc | Hacker News Reader

This is something I've been talking about for a while. Back in 2009 I gave a presentation at Virus Bulletin on JavaScript security problems and highlighted some statistics on remotely loaded JavaScript:

1. 47% of the top 1,000 web sites include google-analytics.com

2. 69% include a remotely loaded web analytics solution

3. 97% load something remotely

If you can attack any of these you get access to a very large number of web sites and can inject arbitrary code. Clearly forging the SSL certificate for SSL loaded remote JavaScript is one way in, another is an attack on the DNS of non-securely loaded remote JavaScript.

At the time techcrunch.com loaded 18 different JavaScript elements remotely. Attacking one would allow a complete site takeover using JavaScript. And those 18 elements could easily have been loading other elements so that attack could have been done through a third-party.

A quick survey in the UK shows that the banks HSBC, Lloyds TSB, Royal Bank of Scotland all load third-party JavaScript on the secure page used for online banking login. Barclays look like they are not, but in fact the domain they are using for one piece of JavaScript is a CNAME for a third-party.

Yet people laugh at me for being a paranoid silly tin-foil-hat nerd if I tell them that I browse with Javascript disabled by default and if a site requires it I am more likely to simply close the tab and move on before I enable it.

I think it's time to install noscript for chrome.

Chrome has some script-control features built in that I use heavily. What would I gain from a chrome extension?

I can't find anything that provides those features. Can you let us know where it is? (Chrome 13.0.782.112 on Linux)

settings -> under the hood -> content settings

Oh, ok, I did know about that one.

Why I use NotScripts: the extension lets you enable JS temporarily or permanently for a particular website with just a mouse click. As well, at the same time, you can do the same thing for any third-party JS because it presents you with a list of them. So you can enable jsquery and disable google-tracker at the same time.

It's much easier than navigating the menu system to add an exception to the list of blocked sites for each time you just want to read a PDF, for example. That's the main use-case for me.

Isn't the purpose of NoScript (in this context) defeated if you use Chrome?

After I started using NoScript, I was amazed at how many sites load Javascript from other sites. Google-analytics is common but I have noticed more and more sites are trying to load Facebook scripts as well.

Happily, my bank doesn't load Javascript from anywhere else.

Or so you think - as the parent says, it just takes a DNS entry to make somebody else's server appear to be yours.

That, or they might proxy a remote JS file through a script on their servers. I've seen that done a number of times.

> After I started using NoScript, I was amazed at how many sites load Javascript from other sites.

Not only that, but I was surprised how much paranoia-induced plugins like NoScript and RequestPolicy induce paranoia themselves. And not entirely without cause, either: sites that load 5 different analytics systems are not uncommon, and I've seen 10 different ad providers on a single page.

Reply on news.ycombinator.com