ScriptSafe former ScriptNo: Discussion

Discussion in 'other software & services' started by andryou, Nov 15, 2011.

Page 3 of 11
  1. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    He had another response. Got to it.

    Feel free to read/ discuss haha
     
    Hungry Man, Nov 22, 2011
    #51
  2. EboO

    EboO Registered Member

    Joined:
    Mar 12, 2011
    Posts:
    287
    Re: ScriptNo: Discussion

    Thanks for the precisions Hungry Man.
    Do you know how webrequest api will takes care about https forced ?
    And clickjacking will be protected by scriptno (via webrequest api) or by chrome itself ?
     
    EboO, Nov 22, 2011
    #52
  3. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    I'm fairly certain I've said it explicitly stated by Chromium devs that it would allow for force-https by extensions. By seeing the "http" request before it's made you can make it an https request as it's sent rather than a redirect.

    Neither.

    Or well... not so elegantly as with NoScript.

    NoScript uses what's called clearclick to stop clickjacking. It's a very nice way to do it.

    ScriptNo and Chrome don't offer this.

    Still, if you block iframe tags and javascript you won't have clickjacking. The issue is that if you allow/ trust a site it will be able to clickjack.

    NoScript will protect you whether it's whitelisted or not.
     
    Hungry Man, Nov 22, 2011
    #53
  4. EboO

    EboO Registered Member

    Joined:
    Mar 12, 2011
    Posts:
    287
    Re: ScriptNo: Discussion

    I've found something about chromium and https : chrome://net-internals/#hsts
    We can add a list of sites we want to connect on https.

    About clearclick and blocking iframe, ghostery scans current page for iframe (in firefox), if it can help for security perhaps it will be present in the chrome version when webrequest api will be stable.
    Perhaps chrome will implement a function for clickjacking in the future...
     
    EboO, Nov 22, 2011
    #54
  5. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    Have you tested that page?

    It's possible that Chrome will implement that function in the future but I'm not sure.

    Webrequest API won't help with clickjacking in terms of a solution similar to clearclick.
     
    Hungry Man, Nov 22, 2011
    #55
  6. EboO

    EboO Registered Member

    Joined:
    Mar 12, 2011
    Posts:
    287
    Re: ScriptNo: Discussion

    If you add a domain it works, i've tried it quickly.
    You can find more informations here : http://dev.chromium.org/sts
    I'm disapointed for clearclick :s
     
    EboO, Nov 22, 2011
    #56
  7. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Re: ScriptNo: Discussion

    I don't know whether it's a bug or not, but these last days I upgraded Chromium, and HSTS will no longer remember the domains I entered. Once the session ends they will be discarded.

    I searched Chromium forums for issues, and I've seen one from August, where a user reported it and he/she was told that it is by design now... Kinda pointless, isn't it? o_O I mean, we got to hope that webmasters will do it for us...

    -https://code.google.com/p/chromium/issues/detail?id=94894
     
    m00nbl00d, Nov 22, 2011
    #57
  8. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    the HSTS may not be meant to hold info past a session
     
    Hungry Man, Nov 22, 2011
    #58
  9. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Re: ScriptNo: Discussion

    Well, it used to. For a long time... I wonder why they've decided to kill the way it worked.

    There's no point in having to manually force domains to use https, every single session. Is there? o_O o_O :doubt:
     
    m00nbl00d, Nov 22, 2011
    #59
  10. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    Not that I know of. It may simply be a glitch with your particular Chromium build.
     
    Hungry Man, Nov 22, 2011
    #60
  11. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Re: ScriptNo: Discussion

    I thought about that. But, according to the issue thread over Chromium's forums, the functionality was taken away in August. I truly don't remember how long I kept my previous build; so I can't tell for sure when this started.

    But, a Chromium developer did answer to that person, back then, that it was meant to work this way now.

    I'm going to report it as well and see what they say about it. It's really a freakish situation.
     
    m00nbl00d, Nov 22, 2011
    #61
  12. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    I suppose it's mroe for testing purposes and it can cause conflicts with extensions/ websites... idk.
     
    Hungry Man, Nov 22, 2011
    #62
  13. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    Opera's got all of 5 users though so it's not really time well spent haha

    I like the antisocial bit as well. All of my privacy settings are on and Unwanted Content is "Strict" with referrer spoof to "Same Document."
     
    Hungry Man, Jan 20, 2012
    #63
  14. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Re: ScriptNo: Discussion

    What's all that with Opera? Did you just wake up from a bad dream? :D
     
    m00nbl00d, Jan 20, 2012
    #64
  15. Daveski17

    Daveski17 Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    10,239
    Location:
    Lloegyr
    Re: ScriptNo: Discussion

    Yeah, although that may boost to six or seven with some decent security extensions LOL.

    It's early days yet & I shall have to spend some time fiddling about & playing with it. Oh no, I think I've become a security extension geek. Well, I'll have fun anyway. If I can get on well with it I'll try it on my desktop computer as well. That's running Win 7 64 bit as opposed to Vista 32. I doubt that the OS will really matter. I think I'm using the same extensions on both machines. It's a shame about the slight incompatibility with Iron. Although I have a couple of different extensions on Iron compared to Chrome. That may be a factor. I'll have to get more familiar with it on Chrome first & see what's happening there. Chrome isn't my default so I can afford to use it for more experimental surfing, so to speak.
     
    Daveski17, Jan 20, 2012
    #65
  16. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,146
    Re: ScriptNo: Discussion

    lol I was responding to another topic but it was more relevant to post it here :p

    Haha perhaps that's the deciding factor...

    It needs some tweaking on the devs side. Getting extensions compatible with it is probably what I'd focus on as a next step. We'll see.
     
    Hungry Man, Jan 20, 2012
    #66
  17. Daveski17

    Daveski17 Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    10,239
    Location:
    Lloegyr
    Re: ScriptNo: Discussion

    Well, it's a fairly new extension I suppose. So far, I much prefer it to any other of the similar extensions (that aren't NoScript). I think in some ways it is more user friendly than NS. The overall interface design is well thought out & not as intimidating as NS can be (especially to those new to it).

    From the many discussions & threads here I think it is a given thing that Chrome is the most secure 'out of the box'. Iron is probably equal or close behind. Probably because of the flash sandboxing, Chrome has the edge on Iron. I am not sure if there are any swings & roundabouts. Firefox has a load of good security extensions of course.

    However, most Opera users seem to be convinced that it is secure enough alone without anything else. I very much doubt this. I wouldn't use it as my default browser, that's for sure. It's difficult enough to adblock properly on it as it is.
     
    Daveski17, Jan 21, 2012
    #67
  18. wat0114

    wat0114 Guest

    Re: ScriptNo: Discussion

    A little ot question, but it seems like a logical place to ask: I notice Googlepack is discontinued, so does this mean installing Chrome is limited to user space, or is there an alternative method for installing into program files directory? I'm thinking of dropping IE9 and going with chrome and this ScriptNo extension.
     
    wat0114, Jan 21, 2012
    #68
  19. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Re: ScriptNo: Discussion

    WTH? :eek: :rolleyes: This coming from you? :D

    There you go... -https://support.google.com/installer/bin/answer.py?hl=en&answer=126299

    :thumb:
     
    m00nbl00d, Jan 21, 2012
    #69
  20. vasa1

    vasa1 Registered Member

    Joined:
    May 1, 2010
    Posts:
    4,417
    Re: ScriptNo: Discussion

    You should be able to install Chrome from portableapps.com virtually anywhere. When I was on Windows, I used that version of Chrome quite happily.

    I'm typing this from memory and so it may not be correct but the only caution seems to be to have a short path like drive:/PortableApps/Your_particular_apps. This last folder will be created by the installation procedure once you point to drive:/PortableApps.

    The last I know was that the portableapps.com version didn't have the (much hated by some) updater. And so I would have to update depending on news here.
     
    vasa1, Jan 21, 2012
    #70
  21. wat0114

    wat0114 Guest

    Re: ScriptNo: Discussion

    LOL! yeah, so much for my allegience to IE :rolleyes: :D Thank you for that link!

    Excellent, another option. Thanks!
     
    wat0114, Jan 21, 2012
    #71
  22. vasa1

    vasa1 Registered Member

    Joined:
    May 1, 2010
    Posts:
    4,417
    Re: ScriptNo: Discussion

    And no registry entries to worry about, AFAIK. Everything will be in the PortableApps folder.
     
    vasa1, Jan 21, 2012
    #72
  23. wat0114

    wat0114 Guest

    Re: ScriptNo: Discussion

    :thumb:
     
    wat0114, Jan 21, 2012
    #73
  24. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Re: ScriptNo: Discussion

    Maybe you'll be interested in the following:

    -https://support.google.com/a/bin/answer.py?hl=en&answer=187206
    -http://www.chromium.org/administrators/policy-list-3
     
    m00nbl00d, Jan 21, 2012
    #74
  25. wat0114

    wat0114 Guest

    Re: ScriptNo: Discussion

    Incredible how much granularity is afforded in the policy. Thanks m00nbl00d!

    BTW, I'm using Chrome now with ScriptNo. Now that I've got a handle on how it (ScriptNo) works, I'm really liking it :thumb:
     
    wat0114, Jan 22, 2012
    #75
Page 3 of 11
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...