InformAction Forums

Giorgio Maone wrote:Should be fixed in latest development build 2.2.2rc3.
Please confirm, thank you.

Confirmed fixed. Thanks.

Confirmed as a bug, will try to fix it in 2.2.3 or sooner. Thanks! Not if the bank is vulnerable to the injection attack described in the FAQ above, which NoScript prevents. Not sure if I understand the exact mechanism of how information can be stolen if the only IP address that can be connected to...

Yes, apologies for not posting the step by step instructions. I generally always do when it comes to stuff like this. Just got lazy I guess haha. Anyway, have a look at this and see if you still think it's not a bug (see bolded parts in particular): 1. Windows XP, SP3, 32-bit, Administrator account....

I probably should have given step by step instructions as to how to reproduce the issue from the start. Anyway, here it is: 1. Windows XP, SP3, 32-bit, Administrator account. No other software installed except Firefox 8.0.1. 2. Install the Firefox add-on NoScript 3. Navigate to the NoScript ABE sett...

So, the same questions: Is Fx sandboxed *within the VM*? No, it is not sandboxed. Sandboxie is not even installed within the VM. In fact, nothing is, except Firefox (and NoScript) - it's a freshly installed Windows XP. Do you have Admin privilege *within the VM*? Yes, I have Admin privilege within ...

This is easily reproducible for anyone using a VM. I can't remember having such an issue when using XP in a VM. Also, it doesn't make sense. When did you test it? Yes, it doesn't make sense at all. But I was surprised that I could reproduce it in a freshly installed Windows XP (Administrator accoun...

With Admin privilege? Not sure what this has to do with Sandboxie potentially causing the issue when I can reproduce it outside of Sandboxie? Exactly. Which is why it's not saving the "disable ABE" change that you made *inside the VM*. I think you have mis-understood (or perhaps you're no...

And definitely *not* after updating Sandboxie? ... "freshly installed" VM should require a write permission, too, as suggested above. No, I don't think Sandboxie has anything to do with it, as I can reproduce the issue outside of Sandboxie. Not sure what you mean by the VM requiring a wri...

Thanks for the information. I think I'll probably leave it alone, as it sounds like it's a Limited User Account issue etc, which is something I will not change - the main use of NoScript for me is actually to load web pages faster haha (since it blocks a lot of "junk"). The odd thing is th...

Yes I do run Firefox sandboxed by default, but I've tested this issue outside of Sandboxie and I can reproduce it. However, I'm testing in a Limited User Account on Windows XP - are you also on Windows XP? I've also tested in a freshly installed VM (Windows XP) in an Administrator account and can al...

ssj100 wrote:Just a note that somewhere along the line, NoScript is forcing ABE codes to be enabled. If you disable the code and restart Firefox, the code will be "automatically" enabled again. Giorgio Maone, pretty sure this is a bug?

Can anyone reproduce this? Thanks.

(Split as O/T from NS Development, HTTPS Mixed content by Tom T.) Just a note that somewhere along the line, NoScript is forcing ABE codes to be enabled. If you disable the code and restart Firefox, the code will be "automatically" enabled again. Giorgio Maone, pretty sure this is a bug?

One thing I note is that with the rule enforced, this "Security Warning" doesn't come up in Firefox: http://ssj100.fullsubject.com/security-f7/web-based-keylogger-attack-t287.htm#2271 That makes sense, with http blocked the page is no longer mixed. Yes, I guess that does make sense. Howev...

One thing I note is that with the rule enforced, this "Security Warning" doesn't come up in Firefox: http://ssj100.fullsubject.com/security-f7/web-based-keylogger-attack-t287.htm#2271 My thinking is that perhaps it's best to disable this rule by default, and when Firefox pops up the "...

Gosh, that's a bit complicated - too much for me I think. But thanks for the tutorial. I haven't come across a site that's broken on me yet (I never use twitter) anyway, so I'll just be using that http to https rule by itself. Firefox (and even IE 6) would tell you of potential mixed content issues ...