NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/
In fact "common users" shouldn't touch them without guidance.DarkBlood wrote:Thank you therube, I understand better now but still ABE settings are too complicated to common users
Giorgio, are you also considering to enhance ABE in such a way that Noscript will become an alternative to CsFire? I understand that ABE already offers what CsFire does but it's simply not user-friendly enough to use it that way. Would be highly appreciatedGiorgio Maone wrote:In fact "common users" shouldn't touch them without guidance.DarkBlood wrote:Thank you therube, I understand better now but still ABE settings are too complicated to common users
The built-in rules already give significant protection against attacks from internet to intranet.
Code: Select all
# This rules allows authentication data to be sent with requests originated
# from the same base domain, stripping it off otherwise
Site *
Accept from SELF++
Anon
Ah - I had used the rule you had mentioned in http://forums.informaction.com/viewtopi ... 99&start=0& :Giorgio Maone wrote:CsFire's behavior can be implemented with this one simple rule (to be put in the USER ruleset):Code: Select all
# This rules allows authentication data to be sent with requests originated # from the same base domain, stripping it off otherwise Site * Accept from SELF++ Anon
Code: Select all
Site *
Accept from SELF
AnonBecause it would probably break any web site which spans across different domains linking back and forth (many financial sites have this kind of setup), so if you're not prepared to opt-in and possibly put exceptions to this behavior, it would come as an unpleasant surprise.Nate wrote:Could you please summarize why this rule is not included by default?Giorgio Maone wrote:CsFire's behavior can be implemented with this one simple rule (to be put in the USER ruleset):Code: Select all
# This rules allows authentication data to be sent with requests originated # from the same base domain, stripping it off otherwise Site * Accept from SELF++ Anon
Giorgio Maone wrote:Because it would probably break any web site which spans across different domains linking back and forth (many financial sites have this kind of setup), so if you're not prepared to opt-in and possibly put exceptions to this behavior, it would come as an unpleasant surprise.Nate wrote:Could you please summarize why this rule is not included by default?Giorgio Maone wrote:CsFire's behavior can be implemented with this one simple rule (to be put in the USER ruleset):Code: Select all
# This rules allows authentication data to be sent with requests originated # from the same base domain, stripping it off otherwise Site * Accept from SELF++ Anon
very old guy wrote: Could someone please give an example of "opt-in and possibly put exceptions to this behavior"? Yahoo Mail! would be a fine test case I believe; popular and at times has been prone to Cross-Site risks, and absent exceptions there are layout problems at a minimum.
Code: Select all
Site .yahoo.com .anyothersiteyouwanttoprotect.com
Accept from SELF++
Anon