InformAction Forums

Note: This topic started at the Mozilla forum.
Kindly see/read:
http://forums.mozillazine.org/viewtopic ... &t=2759453

Re.: Problem w Online banking, unless disable Noscript.

Hello:

Previously, was able to use all features of on-line banking, including transfer funds, with Noscript, without any problem at all.

About a week ago, things changed. Tried to transfer funds on bank website, and got kicked to a bank log-in page. Now, all banking features work, except for the transfer funds function. Whenever I try to transfer funds, I get kicked to a log in page--never ending loop. So, can not transfer funds.

Attempted remedies.
#1 Changed to accept scripts globally, then restart Seamonkey. Still same problem with transfer function.
#2 Disabled Noscripts (Tools/Add-ons Manager/Extensions). Now I can use transfer function--transfers work.

Issue: Any way to get Noscript to work like it used to, ie. it allowed bank transfer functions ?
If no, the will uninstall.

Noscript:
Following below is a copy of previous postings on this topic at the Mozilla forum.
This will provide some info on what has already happened.
Problem persist.

==================================================

Appreciate your effort, but, no help. Read orig. posting.
Been there, done that, or else Noscript would not allow me into the banking site at all.
I repeat, Noscript does not allow the transfer function--allows all other banking functions, but NOT transfer.

Noscript does not allow the entire web address.
Noscript only uses a blurb of the address.
In this case "netteller.com".
"netteller.com" has been on the whitelist since I installed this Noscript some weeks ago,
and had been able to access all banking functions, including transfer, until just a couple of days ago.
Now, noscript allows all banking functions EXCEPT TRANSFER.

Still, as another problem, the "allow" button in Noscript is always grayed out when I try to allow
any https (note the "s") web address.
===================================================

Following up on your good posting, and, many thanks for you time

#1 This site, http://www.neteller.com/ ?

No, Correct is neTTeller (two ‘T’s). I log onto my bank at the bank website, ie. mybank.com then its somehow links with http://www.netteller.com for web banking features. Netteller must be some contractor used by my bank.

#2 Anything (NoScript) related in Error Console (Ctrl+Shift+J) ?

Yes. I logged into my bank, then cleared error console so that it would be clean before I clicked on “transfer”. Then clicked on transfer and immediately got kicked to a log on screen. Error console had a fresh batch of something. Now, to make matters even more ridiculous, seamonkey error console does not have a print function, so, I can’t preserve or post the load of stuff generated by one simple “transfer” attempt.

If you have any idea on how I can retrieve this info, then kindly let me know.

#3 If you disable ABE (not sure if browser restart is necessary?), does the problem persist? NoScript | Options | Advanced -> ABE

Disabled everything in ABE, then restart, and problem persists.

#4 Other then NoScript, do you have other extensions?

Yes:
Chatzilla 0.9.90 -Never used it and don’t plan to.
DOM Inspector 2.0.13pre -Don’t even know what this is.
Javascript Debugger 0.9.89 -Don’t even know what this is.

#5 If you disable all other extensions except for NoScript, does the problem persist?

Disabled all other extensions, enabled Noscript, and problem persists.

Am self employed. This is my WORK computer.
No gaming or horseplay, just old fashioned toil--blood, sweat, and tears.
A pure work computer. So, it is imperative that this machine run smoothly.

I have used Seamonkey for years, and done my banking without a problem.
Even used Noscript for a few months, without a problem.
No, it appears that Noscript will not allow me to transfer funds.
This is a definite NO-GO.
If can't fix, then Noscript will go the "uninstall" route of all problematic software.
========================================================================
About Seamonkey: Ver. 2.21
User agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21

I was going to post a long troubleshooting list here, but it looks like he got the problem fixed over at the MozillaZine forums by disabling XSS on the bank site. Any way to whitelist something in that case?

> fixed

Well if disabling XSS altogether is a fix .
Still need the message from Error Console to see if an XSS exception can be come up with.

Would post the results of the error console,
but mozilla browser, Seamonkey/Firefox 24
does not provide a print function,
and the copy/paste function would have to be
done 50 times or so since can only copy error entry at a time,
can not scroll through and select the entire list as one.
The piecemeal cut/paste would take me 20 minutes.
Not my cup of tea. Have other things to do.


Re. "Well if disabling XSS altogether is a fix." What does that remark mean ?

Well, since I don't have an account at your bank, I can't see what the error message is...if we could see the exact request that is being filtered, then we could help you to write an exception rule.

Are there lines on the Info tab starting with [NoScript XSS] ?

Re. "Well if disabling XSS altogether is a fix." What does that remark mean ?

It means that you have disabled XSS protections, everywhere, instead of coming up with a work-around for your one particular situation.

Looks like banking sites are a problem for NoScript. In my case starting today I can not log on to my banking site with my laptop. Tried disabling scripts that worked for one log in. So, now I am disabling NoScript on the laptop. My time is worth money I am not going to spend more of it fighting this problem that should not exist. I have 4 other computers, right now they are working on banking. BUT soon as that stops I will remove NoScript from each of them. Sorry to report such negative results but that is what has happened for me.

It was fun while it lasted.

Running Linux Mint 13 Mate here.

thanks for reading
bill

@Jivabill: If you're still around, you could try:

• Running in 'Scripts Globally Allowed' mode to see if the problem goes away (you'll still be protected from other attacks like clickjacking and XSS).
• Posting here any NoScript-related messages from the Browser Console (Ctrl+Shift+J) that occur when you try to use your bank.
• Using Adblock Plus with the anti-malware subscription, which should give you *some* measure of protection with minimal time spent.