How to disable only some JS commands

Ask for help about NoScript, no registration needed to post
Peter6548

How to disable only some JS commands

Post by Peter6548 » Tue Sep 02, 2014 6:45 pm

Hello
To disable JavaScript complete is no practical solution. But I want to disable some commands.

Code: Select all

screen.*
navigator.*
Is this possible? Or do you know a add on for Firefox to do it?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0

barbaz
Senior Member
Posts: 9172
Joined: Sat Aug 03, 2013 5:45 pm

Re: How to disable only some JS commands

Post by barbaz » Wed Sep 03, 2014 12:54 am

about:config -> create string pref named "noscript.surrogate.propertykill.replacement" (no quotes) with value

Code: Select all

Object.defineProperty(window, "screen", {set:function(){}});Object.defineProperty(window, "navigator", {get:function(){return {}}, set:function(){}});


then create another string pref with name "noscript.surrogate.propertykill.sources" and value

Code: Select all

@^https?://


(I can understand zapping window.screen, but why would you want to zap the entire window.navigator object? If you think that's going to help your privacy, think again, because it would actually making you more unique on any sites where you enable JS. For a privacy use case, you would be better off with something like Random Agent Spoofer rather than a surrogate script.)
*Always* check the changelogs BEFORE updating that important software!
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:31.0) Gecko/20100101 SeaMonkey/2.28

Peter6548

Re: How to disable only some JS commands

Post by Peter6548 » Wed Sep 03, 2014 6:39 am

Great. That's what I'm looking for. Is there a documentation anywhere about it? I can't find it.

[quote="barbaz"
(I can understand zapping window.screen, but why would you want to zap the entire window.navigator object? If you think that's going to help your privacy, think again, because it would actually making you more unique on any sites where you enable JS. For a privacy use case, you would be better off with something like Random Agent Spoofer rather than a surrogate script.)[/quote]

You are right. It's more for a common testing setup (I'm writing on a book). One of my "problems" is that the browser tells all my fonts. Maybe I use a font it is not good that someone knows it....
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0

barbaz
Senior Member
Posts: 9172
Joined: Sat Aug 03, 2013 5:45 pm

Re: How to disable only some JS commands

Post by barbaz » Wed Sep 03, 2014 4:24 pm

Peter6548 wrote:Is there a documentation anywhere about it? I can't find it.

http://hackademix.net/2011/09/29/script-surrogates-quick-reference/

Peter6548 wrote:One of my "problems" is that the browser tells all my fonts.

JS/CSS can set fonts, but AFAIK it requires Flash (or some other plugin) to actually fingerprint you based on them... (am I wrong?)
In any case I'm pretty sure that window.navigator is completely unrelated to fonts.
*Always* check the changelogs BEFORE updating that important software!
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:31.0) Gecko/20100101 SeaMonkey/2.28

Peter6548

Re: How to disable only some JS commands

Post by Peter6548 » Wed Sep 03, 2014 6:48 pm

Peter6548 wrote:JS/CSS can set fonts, but AFAIK it requires Flash (or some other plugin) to actually fingerprint you based on them... (am I wrong?)

I'm not sure. Normally you use Flash but it is possible without: http://www.lalit.org/lab/javascript-css-font-detect/

May I ask an other question?
I try to delete only the screen part. but have no success. This did not work (on https://panopticlick.eff.org/):

Code: Select all

Object.defineProperty(window, "screen", {set:function(){}});

What make I wrong?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0

barbaz
Senior Member
Posts: 9172
Joined: Sat Aug 03, 2013 5:45 pm

Re: How to disable only some JS commands

Post by barbaz » Wed Sep 03, 2014 7:09 pm

Peter6548 wrote:I'm not sure. Normally you use Flash but it is possible without: http://www.lalit.org/lab/javascript-css-font-detect/

Interesting link, thanks. I'll play with it more when I have more time.

Peter6548 wrote:May I ask an other question?
I try to delete only the screen part. but have no success. This did not work (on https://panopticlick.eff.org/):

Code: Select all

Object.defineProperty(window, "screen", {set:function(){}});

What make I wrong?

Looks right to me...
Set noscript.surrogate.debug to true, then check the Browser Console for related messages?
If none...

Well, I can't get that site to realize when I have JavaScript enabled, so I can't help you there, sorry.
Most likely they're using some other method to detect screen resolution.
You can double check by looking at the source code (and if necessary, using a tool like Firebug).

Is screen detection blocked on other sites (say, something like http://www.mdgx.com/bpr.htm) for you?
*Always* check the changelogs BEFORE updating that important software!
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:31.0) Gecko/20100101 SeaMonkey/2.28

Post Reply