Page 1 of 1

NoScript, is it still necessary?

Posted: Mon Jul 02, 2018 11:49 am
by Anakunda
Hi. does still NS have some unique functionality when we have powerful adblockers nowadays, such as uBlock Origin, which is able to block all scripts by default and allow them selectively per site?

Re: NoScript, is it still necessary?

Posted: Mon Jul 02, 2018 12:49 pm
by Giorgio Maone
Anakunda wrote:Hi. does still NS have some unique functionality when we have powerful adblockers nowadays, such as uBlock Origin, which is able to block all scripts by default and allow them selectively per site?
Yes it is.
NoScript is not an adblocker by any means (for instance it doesn't even attempt to block images), but it takes its mission as a security enhancer very seriously: i.e. it's not meant to watch against annoyances, but to prevent as much as possible attacks on your web security.

Therefore NoScript goes to great lengths to ensure that potentially malicious active content doesn't work around either the "standard" security boundaries expected by the browser or the additional ones declared by the user as NoScript permission.
One egregious example of these additional countermeasures is the XSS filter, which prevents untrusted / default websites (which cannot run scripts by themselves because of their permissions) to inject code into a (likely) trusted site (e.g. mozilla.org), therefore getting it to run anyway.

It's not by chance that the Tor Browser integrates NoScript, rather than "an adblocker", in order to provide its users (who sometimes depend on it even for their physical security) with the maximum protection available.