InformAction Forums

Hi,
I'm using some network hardware (gateway, printserver etc) which have web interfaces for configuration. So I think it would be helpful if noscript would auto whitelist local ip adresses (192.168.x.y).

Without even trying to think of ways in which this could be misused (exploited), is it really so difficult to click *once* on "Allow 192.168.1.1", as I once did, and never have to bother again? (I have a similar setup.)

Or to open NoScript > Options > Whitelist and add https://192.168.1.1? (I'm assuming you took the additional precaution of configuring the router's Web interface to accept only secure, https connections.)

Being a holiday, I'll leave to others the challenge of finding exploits for the fact that not all hw uses the same local IP, so the proposal would indeed have to be in the wildcard form of 192.168.*.*. ... or whether any hw uses other non-publicly-routable spaces, like 5.x or 10.x. (Hamachi VPN uses 5.x.x.x)

Tongue-in-cheek, couldn't the "allow" have been done more quickly than the post here?
Happy Thanksgiving Day from the USA!

Ostfriese wrote:I think it would be helpful if noscript would auto whitelist local ip adresses (192.168.x.y).

I think that's covered already by subnet matching.
http://noscript.net/features#sitematching
Whitelisting 192.168 should allow your whole subnet.

Alan Baxter wrote:

Ostfriese wrote:I think it would be helpful if noscript would auto whitelist local ip adresses (192.168.x.y).

I think that's covered already by subnet matching.
http://noscript.net/features#sitematching
Whitelisting 192.168 should allow your whole subnet.

Thanks to Alan for pointing to that. However, you still might consider considering securing the web interface to allow only https connections.

The FAQ isn't clear on whether subnet matching permits protocol matching as well, e. g. https://192.168.

Which is why Giorgio's FAQ and my humble opinion are in agreement:

Giorgio Maone wrote:By the way, most of the time you prefer not to fiddle with your whitelist manually: just use the NoScript "Allow" and "Forbid" menu items, it's much simpler and error free!

Disconnect from the internet for safety, open the interface, allow 192 etc., configure to https if not already done so. Probably have to re-login to https://192.whatever. Then allow https://192.168.whatever.whatever yours is, and revoke the permission for http://192.etc.

Just hardening it a little bit more, says the guy in the tinfoil hat.