Noscript for Google Chrome?

Bug reports and enhancement requests
dhouwn
Bug Buster
Posts: 968
Joined: Thu Mar 19, 2009 12:51 pm

Re: Noscript for Google Chrome?

Post by dhouwn »

HSTS simply tells the client that this site should from now on for a certain time be only accessible through encrypted protocols.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0
Hungry Man
Junior Member
Posts: 43
Joined: Wed Oct 19, 2011 9:42 pm

Re: Noscript for Google Chrome?

Post by Hungry Man »

Right, the idea is to prevent MITM attacks where you 'fake' the SSL. That's what SSL Strip does. HSTS doesn't allow the HTTP at all so the connection would either fail or use HTTPS.

But I thought this had to be both implemented by the server and the browser - so I'm unclear as to what NoScript does with HSTS.

Regardless I've updated the NoScript area of the guide to elaborate on the protections gained even with Scripts Globally Enabled.
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.21 Safari/536.11
dhouwn
Bug Buster
Posts: 968
Joined: Thu Mar 19, 2009 12:51 pm

Re: Noscript for Google Chrome?

Post by dhouwn »

NoScript had the user-customisable HTTPS enforcement feature for years and then provided HSTS support to Firefox 3.6 and earlier (native support landed in Firefox 4).

The server needs to be changed in such a way that is supports HTTPS on every page on this particular domain (and does not do dumb things like redirecting to HTTP on some pages) and that it informs the user agent that it would like to have this enforcement.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0
Hungry Man
Junior Member
Posts: 43
Joined: Wed Oct 19, 2011 9:42 pm

Re: Noscript for Google Chrome?

Post by Hungry Man »

Gotcha, thanks.
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.21 Safari/536.11
heavyweight
Posts: 8
Joined: Wed Mar 07, 2012 10:47 pm

Re: Noscript for Google Chrome?

Post by heavyweight »

is noscript out for google chrome Know ?
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3365
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ »

heavyweight wrote:is noscript out for google chrome Know ?
If you search the forum, it has been discussed, but the simple answer, NO, not yet.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0
Hungry Man
Junior Member
Posts: 43
Joined: Wed Oct 19, 2011 9:42 pm

Re: Noscript for Google Chrome?

Post by Hungry Man »

I think one of the current issues is the asynchronous WebRequest API being the only current option. With the declarative WebRequestAPI there's a synchronous option.

Just an FYI as this API is new.

https://code.google.com/chrome/extensio ... quest.html
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:13.0) Gecko/20100101 Firefox/13.0.1
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3365
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ »

We've been aware of this and other API since v17 and 19 beta and that's why Giorgio has been trying to work on a port, it will be available when its available and when Google's crappy APIs catch up, so everyone just drop it and wait. Its not like if we had it we would keep it a secret, its getting old constantly asking for it.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Hungry Man
Junior Member
Posts: 43
Joined: Wed Oct 19, 2011 9:42 pm

Re: Noscript for Google Chrome?

Post by Hungry Man »

It's a separate API from the WebRequest API, which is why I ask.

One of the issues with porting NoScript would be that you need Synchronous events. Chrome's extension system largely on supports asynchronous events for performance reasons. The WebRequest API introduced in Chrome 17 is asynchronous, meaning you can't use it to reliably block anything (see ScriptNo) and you'd have to rely on caching (see NotScripts and ScriptNo) to actually do it (ie: reload the page and it's blocked.) The new API, which I believe is currently experimental and only in Chrome 22 is synchronous meaning that everything stops until that extension says to continue.

Hence why I ask if this makes enough difference - new API = new capabilities.

But the declarative API doesn't provide enough apparently. Though I don't think it hurts to ask lol
Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3365
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ »

Yes we know, Google's API are a mess and inadequate to say the least but we are giving it our best effort, we'll see if an equally reliable tools can be developed or not, if yes, good and we'll release it, if not, then we'll go back to the way it has been, which is wait and see when they remove their heads from their arse :) Our policy has been to do it right or not at all, we are not going the route of those knock off tools that claim to do it while clearly have been shown to fail miserably repeatedly.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
heavyweight
Posts: 8
Joined: Wed Mar 07, 2012 10:47 pm

Re: Noscript for Google Chrome?

Post by heavyweight »

any update on this yet ? i i'm waiting till the day comes just thought i would check in.
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
Tom T.
Field Marshal
Posts: 3620
Joined: Fri Mar 20, 2009 6:58 am

Re: Noscript for Google Chrome?

Post by Tom T. »

heavyweight wrote:any update on this yet ? i i'm waiting till the day comes just thought i would check in.
I'm sure there will be a major announcement when ready, but you also may wish to follow Giorgio's blog, http://hackademix.net/
on which he often gives advance notice, or first notice, of new projects, ideas, etc.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:15) Gecko/20100101 Firefox/15
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3365
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ »

As Tom said, its being worked on when time and resources permit, if and/or when it becomes available, we will let everyone know. Its not like we build things to keep them a secret. :P
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
daaebakk
Posts: 1
Joined: Sun Sep 23, 2012 1:47 pm

please launch/e.x.e NoScript for google chrome a.s.a.p

Post by daaebakk »

you are really genius.. dont waste time..just execute first the beta testing/unofficial NoScript for Google chrome..
trust me it will be >> in beta just fix it one by one ,, no need wait lah...from>>malaysian fan

(Merged with topic "NoScript for Google Chrome", and removed one phrase that could conceivably be taken as spamming for a particular musician or band, or one particular recording by that artist -- Tom T.)
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
w33d3r
Posts: 8
Joined: Thu Feb 18, 2010 6:50 pm

Re: Noscript for Google Chrome?

Post by w33d3r »

Giorgio Maone wrote:May I ask you what, exactly, makes Chrome a better choice than Firefox for you?
If this question is still of interest -

The main reason for me would be its Sandboxed processes http://www.google.com/googlebooks/chrome/small_26.html

Speed and stability are factors ( using firefox with the usual barrage of security and privacy plugins makes it feel even worse than its best which cannot compare to chrome )

I used to love FireFox, but no more. I am no google fan either, preferring what I consider a better fork of the Chromium project .. Comodo's Dragon
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.2.0.0 Safari/537.36
Locked