improvment- revoke temporary permitions when leaving domain

[guy]

i would like to offer an improvement to no script- if it would be possible to add an option to revoke temporary permissions once you leave a domain in which you have chosen to make a temporary permission.
in our times many websites and social networks share info with other websites or use scripts to enable use of info in other websites and to be used by those websites.
this if a practice that might violate your privacy simply because you used such social network and gave it a temporary permission and did not revoke it once you left the web site- and such allowed script might be active on third party websites.
ie - when i use facebook and give it temporary permission leave facebook site and go to other website that uses facebook scripts they are enabled and get info on my whereabouts

i would be most gratfull if you would consider adding this option to your most valued no script plugin

thanks
guy

[Tom T.]

http://noscript.net/features

Revoke temporary permissions cancels all the "Temporary allow" commands issued during this session.

So just open the menu and click the Revoke as above, before leaving the site.
However, I think this should be in the NoScript FAQ, to be more easily searchable, and will make that suggestion to Giorgio and the rest of the team.

I think the feature you asked for has some merit, too. I'll bring that up also.

Any other users with opinions on this, please feel free to post, pro or con.

[GµårÐïåñ]

What you are suggesting would not feasible. How would you decide if you have left the domain? If you consider closing the tab as doing it, then what about cases where you have multiple tabs on the same domain open? Otherwise, it would require NS to keep polling the sites on each tab to see if they are still there, that means A LOT of overhead and unnecessary refreshes, although he could setup a form of event listener but even that would not be easy to do and can cause problems of its own.

As is, the temp go away when you close the browser or when you click on revoke temporary permissions, so I believe its complete enough as is, but ultimately I will leave it up to the beloved friend and developer to respond to you.

[Tom T.]

What you are suggesting would not feasible. How would you decide if you have left the domain? If you consider closing the tab as doing it, then what about cases where you have multiple tabs on the same domain open?

Could be user-configured: revoke when a given page or subdomain is no longer active, or revoke when the base second-level domain is gone.

E. g.; I check my mail at mail.yahoo.com, which is whitelisted. Then I open a new tab or window at finance.yahoo.com, to see how much worse the economy got today. Interactive stock charts don't work unless scripting is allowed from finance.yahoo.com, and then a Flash object must be allowed. So I TA both.

When I leave the Finance page, I don't need those any more. So:

1) The subdomain, finance.yahoo.com, no longer has a connection, so all TA enabled there are revoked, OR
2) I choose to keep all TA until the base second-level domain, yahoo.com, no longer has any connections.

If either of these is much more difficult to implement, or much more of a resource hog, than the other, then just one could be implemented.
If neither is a terrible burden on the machine or on the developer , user choice seems suitable.

If I have several tabs open at finance.yahoo.com itself, surely NS sees the termination of the last one? -- which would be the trigger.

but ultimately I will leave it up to the beloved friend and developer to respond to you.

Of course. I would only ask Giorgio to look at it and determine the degree of complexity and resources added vs. convenience in the very common cases described by OP.

[GµårÐïåñ]

@Tom, my statement still holds true even in your case. Say not everyone does their allowing by second level domains like you do and has allowed Yahoo.com as temp and then jumping from yahoo service to service on each tab. Again: how would it know that you no longer need the permission? Just because you closed the tab its gone? what about the other tabs? This means that each time that is done, it has to check EVERY tab to see if anything is still open that matches that permission. From both performance and overhead, that could cause quite a delay in things. Assume someone who has 50 youtube tabs open (I personally wouldn't but we have seen users who have) and you close one tab and you have TA youtube.com, it would revoke ALL of them, or has to poll 50+ tabs to see which ones have the URI youtube and leave them untouched, can you see how that could basically make your browsing interface unusable?

Off the top of my head, the most efficient way he would be able to track all this is to have a separate list which would be populated with the URI of each tab you open and then when you close a tab for it to poll that file and see ok, how many lines of this domain do I have left, if > 0 then leave it allowed, if <= 0 then revoke. Although that can be achieved, it would again cause a huge overhead and processing time. The more tabs you have, the more variations of the domain you have the more time it has to take to process them. To go through ALL THIS so that someone doesn't have to click "revoke" or "forbid" is just lazy and frankly asking for a feature that takes more time to implement than the value it brings to a miniscule lazy portion of the population. Not to mention that say you TA xyz.com and you are working in a tab with it and say you close it or by whatever infrastructure it decides it no longer needs it and revokes it. Then you open another tab and go to the same domain for another reason, you still have to re-TA the site. It makes more sense to leave it open for the session or revoke it as you know you are done with it, than to have it automated for cases where your actions may not be in step with the algorithm raising then another batch of requests saying, oh why does it keep going away?

Why does a security tool have to decide when you need or done needing something? Isn't that supposed to be your responsibility and choice? Just like it wouldn't decide what sites to TA for you, and you do that, it shouldn't have to decide when to de-TA something for you either and you should do it yourself. It already does housekeeping for you by revoking all TA when you close the browser (end your session) what more can be expected? I don't know, maybe Giorgio can explain it better but I just don't see the feasibility of this feature and I know it will cause more problems to the greater population just to satisfy an insignificant (in numbers not worth) segment of the user population. You are just begging for problems when you take choice away from the user.

[Tom T.]

@ GµårÐïåñ: Pretty much what i said: perhaps Giorgio could find a way to do this with low complexity and overhead. If not, or he's not in favor of the idea, then of course, that's the end of the story.

FWIW, in doing support here, I sometimes find myself going to various domains as requested by users, having to TA some scripts, then continuing on. I may even log out of here and go to other browsing, mail, etc., and forget that I still have all these things TA'd (because I wasn't sure when I'd be through with that site, and because I'm ADD-le-brained). You're right; that's my problem.

But *if* it could be done simply and easily... otherwise, I'm with you. Remember to click Revoke. I'll paste a sticky note on my screen to remind me.