Open DNS requires JavaScript?

These last few days I've been running OpenDNS, due to DNSCrypt.

I wanted to see how OpenDNS block pages looked like, so I went to -https://www.phishtank.com/phish_archive.php , and started searching for reports labelled with VALID PHISH.

I entered those sites, and I could enter them fine, except for one, where although there was no block page, I could see from the title bar, that BitDefender TrafficLight was blocking it.

I block JavaScript, so I couldn't see the block page that TL was presenting, but I saw this title: chrome-extension://cfnpidifppmenkapgihekkeednfoenal/alerts/malware/page_blocked.html

cfnpidifppmenkapgihekkeednfoenal is TL's ID.

So, if JavaScript is disabled, then I could access one of the sites, except the one that TrafficLight blocked.

As soon as I enabled JavaScript, OpenDNS blocked access to those two validated phishing websites, that are there at the moment.

Is OpenDNS itself, or is it DNSCrypt that requires JavaScript? Maybe it sounds stupid for DNSCrypt to need it, so probably is OpenDNS itself. I'd have to modify quite a few settings in my system to test it out, so I didn't. I know that Norton DNS didn't need JavaScript, at all.

 

I'm using OpenDNS, and when I access one of the PhishTank websites with JavaScript DISABLED, I simply see a white page with absolutely no content. After I enable JavaScript, I see the appropriate OpenDNS warning screen.

EDIT: sometimes even with JavaScript disabled, I immediately see the OpenDNS warning screen.

 

I'm wondering if it makes any different the web browser we use? I'm using Chromium 20.0.1092.0 (Developer Build 130780 Windows), since yesterday.

 

Look what happens with JavaScript disabled. As I previously mentioned, TrafficLight kicks in. I just can't see the alert, due to JavaScript being blocked. But, if I allow JavaScript, then OpenDNS blocks it first, due to being at DNS level.

So, OpenDNS doesn't block without JavaScript.

 

It would probably help if you disabled Java, and enabled JavaScript along with using NoScript for protection.

Since most web pages use JavaScript, the above scheme works nicely. Disabling JavaScript does not seem to make much sense - but, you have to run the NoScipt plugin to block most kinds of JavaScript attacks.

My $0.02 worth.

-- Tom

 

I appreciate your feedback, and respect that you run NoScript.

But, why exactly would OpenDNS need JavaScript? Norton DNS doesn't need it. ClearCloud DNS didn't need it either. It's odd.

Anyway, DNS translation does work, and that's what I want. Not interested about the phishing protection. I was just wondering how a block page would look like, and I noticed this behavior.

 

I use the latest stable Chrome release - 18.0.1025.xxxxx

I think OpenDNS still blocks regardless of JavaScript, but it might need JavaScript to display the warning message... not sure about this though, but it seems to be my experience with the xx websites I've tried so far. Either way, none of the websites from Phishtank opened.

If you want me to run some test for you (one that doesn't require too much installing/uninstalling) let me know, it's not a problem. I'm fine testing a different browser for that as well - just give me a download link and tell me how to disable JS.

 

Hi m00nbl00d,

Just to clarify, I did not recommend JS as needed for DNS, but merely to keep it available for visiting most web pages as in normal use of a web browser since most web pages depend on it, and, of course, with NoScript, one has control over which scripts to allow.

It is basically a non-issue with DNS lookups afaik.

-- Tom

 

Not that I've done any testing myself, but to me it doesn't look like it requires JavaScript to block pages, merely to display its block page.