InformAction Forums

I am brand new to this forum, so please excuse me if I am addressing this incorrectly:

I recently have had 3 different bank websites (SunTrust, Chase, CitiBank) all stop working with NoScript enabled on the latest version of Firefox 51.0.1 (32-bit).
If it matters I am using Win7 Pro SP 1. When I totally disable NoScript, all 3 of the bank websites start to work correctly. Maybe NoScript recently change it program or rules allowing access? Or was it each individual bank?
Note: I have already whitelisted each of the bank website addresses and they were working fine for years before, but recently they are either hang, or stay connected but cursor just spins, or it freezes up my entire FIrefox Browser, or state that I need to enable JavaScript (all depending on which bank site I am using - each bank seems have a different issue but one that I just mentioned).

It is a pain to have to disable NoScript each time to access any of my Online banks. I did a search previous to this post and some posts suggested just unchecking the 2 XSS boxes. However that did not work for me, so I rechecked them.

I really don't know much about this stuff or any coding, so what ever answers you may reply with, please keep them very simple and spell them out step by step. I do want to keep my online bank accounts safe, so also explain what your suggestion may do in that respect if I make any changes. I don't want globally change something that may make my access unsafe.

Thanks a bunch in advance for any answers that may solve my problem.

When this issue occurs, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)

Unfortunately I can't really get that far with one bank (CitiCard) my entire Firefox freezes and I can't do anything except close it down entirely.
With Chase It states JavaScript is disabled. Enable JavaScript to continue.

Also how do you turn off CSS? I only see a XSS in the NS Advance Tab option list.

MG358 wrote:With Chase It states JavaScript is disabled. Enable JavaScript to continue.

Does this help you with Chase? - viewtopic.php?f=7&t=21977

MG358 wrote:Also how do you turn off CSS?

In the Browser Console (Ctrl-Shift-J), there should be a button at the top saying "CSS", with a drop-down to the right. Click that drop-down, and make sure "Warnings" and "Reflows" are both un-checked.

with one bank (CitiCard) my entire Firefox freezes

Will the freeze eventually subside, if you wait long enough, even up to 5:min?

Do you see (in the status line) it trying to load any domains?

I am getting a similar freeze with a CitiBank website as MG358 described. I also am running Windows 7 Professional SP1, problem occurs on Firefox 51.0.1 and now on Firefox 52.0 as well. Hangs and freezes Firefox; sometimes it appears it's going to get past the error but as soon as I click on anything, the freeze occurs. I get a javascript message. Tried to include some of the message but had to delete it to get past your anti-spam filter.

No matter how I answer that message (open with..., save file, or cancel) I get the freeze. The site works in Firefox if I disable NoScript and it works in Chrome. It worked fine in Firefox until maybe sometime in January or February. Mozilla says it's not their problem, to contact you.

@ThePayetteGirl: Well, it's not NoScript problem either - viewtopic.php?f=7&t=22574

We can try to help you make a workaround if you like.

@barbaz
I have followed a long chain of "viewtopics" each leading me to yet another one and what I have gleaned is that Citi's website is doing (or attempting) something unsafe. I don't understand what that is, but I want to report it to them. At some point in the chain I think saw something about them modifying a frame so that other websites can gain access through that frame or something, but I can't find it again.

Can you help me determine what I should report to CitiBank to define their unsafe practice? I would be grateful.

@barbaz

Should have mentioned that I managed to get a screen shot of some of the log even though Firefox was frozen. Among other things, it contains something about "sanitized window.name". Don't know if that's good or bad, but if you tell me how, I can send you the screen shot. Do I just click 'Img" and then include the .jpg file between the two img commands?

ThePayetteGirl wrote: I want to report it to them. At some point in the chain I think saw something about them modifying a frame so that other websites can gain access through that frame or something, but I can't find it again.

Can you help me determine what I should report to CitiBank to define their unsafe practice? I would be grateful.

They are storing in window.name, something that looks like Javascript. And window.name is accessible to any other site. By "accessible" I mean any site can read and modify it. Bad news if malicious site injects its own scripts.

ThePayetteGirl wrote:@barbaz

Should have mentioned that I managed to get a screen shot of some of the log even though Firefox was frozen. Among other things, it contains something about "sanitized window.name". Don't know if that's good or bad, but if you tell me how, I can send you the screen shot.

Upload it to an image hosting site, then post the link here.

All,
Sorry for the delayed response. I was unavailable for a while to get back to this issue.

Thanks for all the tips and suggestions! Especially a BIG Thanks to barbaz and lindend which solved my Chase issue.

Solution: The tip that actually worked was that I added chasecdn.com to the whitelist. Now I am able to access Chase now while NoScript is still enabled as I was previously before this issue.

Now if I could only figure out what is causing the problems with the other online banks.

Much appreciated!

I'm not familiar with forums and somehow my username incorrectly showed up as MG824. (MSG358 and MG824 are both me.)

Just wanted to thank everybody for their assistance! However my previous post showed my thanks and resolution coming from a different username MG824, instead of MSG358 by mistake. So I wanted to clarify.

^^ Fixed.

And, you're welcome.

OK, now that I got Chase working, I was wondering I could get some assistance on my CitiCard website? https://online.citi.com/ ?
With NoScript enabled, it just freezes my whole Firefox browser when trying to log in. I can't do anything but force close it. (Win7 Prof SP1) However when I disable NoScript, and try again the CitiCard website works fine with Firefox. V52.0 (32-bit)

Any suggestions for this CitiCard website? https://online.citi.com/