Portable Firefox and No Script keeps erasing my Whitelist

[Neil_McCauley]

Hello All,
I have a portable version of Firefox 6.0.1 installed on my USB drive and I added NoScript 2.2.8. Initially it works fine and I can add sites to the whitelist. After I close the portable Firefox and reopen it, my entire whitelist changes to a single line/entry. See the picture for an example of what I mean. I have two other extensions that require that I stay on 6.0.1 so upgrading to Firefox 9 is not an option at this point. I have disabled both of the other extensions installed on my portable Firefox, but the problem still persists. I have run my portable Firefox on a Windows 7 and Windows XP machine, both with admin rights.

NoScript functionality seems to work fine, it is just the whitelist that is a problem. Any assistance is appreciated.



Warm Regards,
Neil

[Tom T.]

I have two other extensions that require that I stay on 6.0.1 so upgrading to Firefox 9 is not an option at this point.

First question: Which is higher on your priority list:
Security, or
Whatever it is those other extensions do?

Also, I still use Firefox 3.6.25, which is supported, at least for security updates, for another few months yet. You could try that, also portable, and see if it works.

Otherwise, using 6.x is extremely dangerous, since there are well-known security flaws in it, or any other browser, that has reached end-of-support.

I have disabled both of the other extensions installed on my portable Firefox, but the problem still persists. I have run my portable Firefox on a Windows 7 and Windows XP machine, both with admin rights.

NoScript functionality seems to work fine, it is just the whitelist that is a problem. Any assistance is appreciated.

Which brand or source of portable Firefox do you use?
I use PortableApps.com, and while I'm not here to plug or endorse any third-party (freeware, btw), product, I've never had a problem in several years of using them.

Other possibility is that the profile in that portable is corrupted. Might be easier just to reinstall it, assuming that you choose to disregard the safety concerns, rather than installing a supported version, which should also clean up most profile issues.

[dhouwn]

Something is stripping the line breaks? Maybe some Windows-specific applications that doesn't understand the Unix linebreaks (just the linefeed character as opposed to carriage return and linefeed)

[Neil_McCauley]

Hi Tom,
Thanks for your reply. The reason I have to use 6.0 is because I'm using it on an IronKey device: http://imationmobilesecurity.com/en/pro ... ash-drives. This device has two applications/plug-ins on it that require that Firefox be at exactly 6.0. In this instance, downgrading to 3 or upgrading to 9 will render these two applications unusable. I am aware of the version I can download from portableapps.com (Great site btw!), but those versions of Firefox will not support the two applications/plug-ins. I was hoping to find a temporary workaround until the IronKey supports 9.0 or whatever the latest version will be. Perhaps there is a setting in the plug-in or in the about:config that will allow the whitelist to behave normally. I appreciate your support.

-Neil

[Tom T.]

Hi Tom,
Thanks for your reply. The reason I have to use 6.0 is because I'm using it on an IronKey device: http://imationmobilesecurity.com/en/pro ... ash-drives. This device has two applications/plug-ins on it that require that Firefox be at exactly 6.0. In this instance, downgrading to 3 or upgrading to 9 will render these two applications unusable. I am aware of the version I can download from portableapps.com (Great site btw!), but those versions of Firefox will not support the two applications/plug-ins. I was hoping to find a temporary workaround until the IronKey supports 9.0 or whatever the latest version will be. Perhaps there is a setting in the plug-in or in the about:config that will allow the whitelist to behave normally. I appreciate your support.

-Neil

I'm mildly familiar with IronKey. Given their commitment to security, it's rather IronIc (get it? ) that there isn't a mechanism to update the built-in portable Fx.

No matter how well-encrypted the key is, surely the browser itself is decrypted on-the-fly to load in RAM -- or not? Still seems a hole could be exploited -- the encryption is mostly for protection against loss/theft, IIUC. (A very worthwhile purpose.)
IIUC, even those running full-disk (HD) encryption are not at all immune from exploits, but I don't use FDE myself, and so haven't researched the details greatly.

http://www.truecrypt.org/docs/, click "Malware".

<snip> If you use TrueCrypt on a computer infected with any kind of malware, TrueCrypt may become unable to secure data on the computer.* Therefore, you must not use TrueCrypt on such a computer.

It is important to note that TrueCrypt is encryption software, not anti-malware software. It is your responsibility to prevent malware from running on the computer. If you do not, TrueCrypt may become unable to secure data on the computer.

Took a *very* quick look at the IronKey site and at the .pdf sheet. Nothing about what version of FxPort. Guess they'd rather not advertise that they have an obsolete version, and no way to update it. Unless you're supposed to buy a new one for every new Fx, which, with Fx's "rapid release cycle", would certainly boost their sales.

Anyway, can you get access to the profile folder of the portable Fx and create a clean one, or even reinstall the Fx Portable 6, in case there's a corruption somewhere? (They happen, even without malware. Magnetic fields, solar flares, alien beams ....)

Also, what does your whitelist look like in prefs.js file, user_pref("capability.policy.maonoscript.sites", .... if opened with Wordpad?
Automatic line-wrapping, as it should, or endless lines no matter how wide the window -- as it would if opened with Notepad, with Format > Word wrap unchecked? (going with dhouwn's thought here)

Your browser useragent shows as

AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.77 Safari/535.7

Any possibility of a conflict there? Seems it should pick a browser and stick with it, at least per session. Or a quirk in IK that displays all browsers installed?

I still have Fx 2.0.0.20 installed on the HD for occasional research/testing purposes, but only the browser in use shows in the UA string.
Might be a lead worth pursuing.

[dhouwn]

Oops, the entries in the noscript.untrusted settings are separated using spaces not newlines, somehow I was mixing this up with other settings like noscript.httpsForced.

BTW, about the stick, you just have to love advertising mumbo-jumbo like:

If a thief tries to break into an IronKey and enters 10 incorrect passwords, the Cryptochip will securely erase all of the encrypted data with patent-pending Flash Trash technology. This ensures no trace of your data can be recovered from the device.

No mention of theoretical even if maybe not likely unreliableness of this (if the bad guy manages to buypass the interface and e.g. reads out the encrypted data directly and then tries to brute-force it), also no mention of that your key you basically just encrypts another key (that might not be intended to be changed*) which then used for encryption. That way you have the "advantage" of not needing to re-encrypt everything if you change your key, but at what cost?

[Neil_McCauley]

Hi Tom,
Thank you for the detailed reply. The reason that IronKey users must remain on 6.0 is because the two extensions are only developed for 6.0 currently. Given the rapid release cycle like you said, upgrading Firefox without updating the extensions will most likely cause them to no longer work as intended.

I renamed the original profile folder Profile-old and launched Firefox and a new profile was created. The two extensions that came pre-installed with the IronKey were gone (expected). I then reformatted the Ironkey and put a fresh copy of Firefox on, installed IronKey's version so I would have the two extensions and only added NoScript, but the problem persists.

Also, what does your whitelist look like in prefs.js file, user_pref("capability.policy.maonoscript.sites", .... if opened with Wordpad?

Ok, well it looks like we may be getting somewhere!
On a fresh install of Firefox and No Script, the whitelist looks great from the Browser under Add-ons then options. I open prefs.js and the line looks good:

Code: Select all

http://paypal.com http://paypalobjects.com http://securecode.com

, etc.
After I close Firefox, prefs.js still looks fine
After I reopen Firefox, the whitelist looks jacked up like the picture I posted and the line in prefs.js runs on forever and I can confirm that there are no spaces, breaks, or http://. I.e. paypal.compaypalobjects.comsecurecode.com, etc.

I use Google Chrome one computer and I use the IronKey's portable Firefox on another computer, so that is why I am registering as Chrome. I'm one of those fortunate enough to have more than one computer, but I only use one browser at a time. When I have more time, I'll compare the two prefs.js files (the good copy and the bad copy) to see of anything else in the prefs file has changed. So far, it looks like the IronKey's Firefox is deleting the http:// and the spaces in the prefs.js file.
I know you're working with one hand tied behind your back, given the fact that I am unable to update to 9 or a version from portableapps.com that is confirmed working, but I definitely appreciate the support.

[Tom T.]

Hi Tom,
Thank you for the detailed reply. The reason that IronKey users must remain on 6.0 is because the two extensions are only developed for 6.0 currently. Given the rapid release cycle like you said, upgrading Firefox without updating the extensions will most likely cause them to no longer work as intended.

Hi Neil,

I'd have wished they'd at least developed them for Fx 3.6.x last year; then, they'd have a long window of opportunity to see the upcoming 7a-8a etc., and to be prepared with any compatibility updates while 6.x was still the stable release -- or if not, give the user the option to use 3.6. But with the 3.6 window closing in April, I don't blame them for not doing so now.

Side note: When I updated from, say, Portable F8 to F9, Firefox does an automatic check, with message "Compatibility updates have been applied to two of your add-ons", etc. But of course, they can't be applied if the devs don't create them.

I renamed the original profile folder Profile-old and launched Firefox and a new profile was created. The two extensions that came pre-installed with the IronKey were gone (expected). I then reformatted the Ironkey and put a fresh copy of Firefox on, installed IronKey's version so I would have the two extensions and only added NoScript, but the problem persists.

Sorry to ask you to go through that again, but as a SOP for diagnosing possible extension conflicts, could you please create a fresh profile, and this time install *only* NoScript*? Then see if the issue persists.

This type of symptom (icons missing, weird appearance and behavior, etc.) is not uncommonly due to an extension conflict. The Standard Diagnostic is MZ's recommendation, but the shortcut above may exculpate NoScript immediately. Then you just see which add-on + NS reproduces the issue, and which doesn't.

If it persists with only NS on a fresh profile, we'll go from there.

Also, what does your whitelist look like in prefs.js file, user_pref("capability.policy.maonoscript.sites", .... if opened with Wordpad?

Ok, well it looks like we may be getting somewhere!
On a fresh install of Firefox and No Script, the whitelist looks great from the Browser under Add-ons then options.

Can you not get to the target merely by opening the NS menu (click or hover on the NS icon, depending on how you set NS Options > General > "Open permissions menu when mouse hovers...") > then click Whitelist tab? Does this change the display of the whitelist?

I open prefs.js and the line looks good:

Code: Select all

http://paypal.com http://paypalobjects.com http://securecode.com

, etc.
After I close Firefox, prefs.js still looks fine
After I reopen Firefox, the whitelist looks jacked up like the picture I posted and the line in prefs.js runs on forever and I can confirm that there are no spaces, breaks, or http://. I.e. paypal.compaypalobjects.comsecurecode.com, etc.

After leaving the last session, I had a couple more thoughts (not uncommon). What about *temporary* permissions?

If nothing is TA'd at the moment, go to two or three trustworthy sites that are *not* in your whitelist -- say, online banks that you don't use. Their home pages will surely want to run their own scripting. Temp-allow it (not any third-party scripts, of course). Now open NS GUI as above. The temp permissions should be on separate lines, in italics, like so:

https//bankA.com
https//bankB.com
https//bankC.com

What do they look like?

Also, Untrusted list. Same thing in prefs.js: user_pref("noscript.untrusted",...." should be separated by one blank space each, auto-wrapping.

In about:config, noscript.untrusted should show as a long line, also with one blank space between each entry. If the mouse is hovered over "Value", a tooltip should appear, browser-width, with however many lines are needed (My Untrusted is many times the size of the Whitelist ), but still with the single blank space as separator.

Might as well get all the diagnostic info we can, if you don't mind.

I use Google Chrome one computer and I use the IronKey's portable Firefox on another computer, so that is why I am registering as Chrome.

As noted, Safari is also showing in the user agent string. It seems that only the browser actually in use should broadcast itself to Web sites, since they need to render pages differently for IE versus many other browsers, and a few minor quirks in each browser. So each site sees your browser string. If there are multiple, it seems the site's server would be confused. Perhaps Chrome vs. Safari, with "Apple Webkit (like Gecko)" is close enough not to matter, but in general, not sure why both are announcing themselves.

(No offense taken at not logging in with Fx, of course! ... as I've explained to one or two people who think that any post from a non-Gecko browser must be spam. )

I'm one of those fortunate enough to have more than one computer,

I'm one of those who has to have more than one computer, because if one has to go in the shop ("stuff happens"), I'd rather not impose on friends (done that), but mostly, hard to trust a machine not in one's personal control. And personal prefs, configs, sw, etc.

but I only use one browser at a time.

Side note, for anyone reading this thread who's interested: Normally, you can have only one version of Fx running at any one time, portable or otherwise. Just recently stumbled on the fact that with a simple change to an .ini file in the Portable, one can run the native and the portable at the same time. So I can browse with both supported versions, Fx 3.6.x and 9.x, tile them side-by-side, and see how any issue, site, etc. displays on each, comparing in real time. Cool.

Sorry for the digression, Neil, but thought that might be of public interest.

When I have more time, I'll compare the two prefs.js files (the good copy and the bad copy) to see of anything else in the prefs file has changed. So far, it looks like the IronKey's Firefox is deleting the http:// and the spaces in the prefs.js file.

Sounds like a very good and logical plan, thanks. ... and have you checked IronKey's support, FAQ, documentation, etc., to see if they're aware of any such bug in their product, or any other bug that could conceivably affect this?

I know you're working with one hand tied behind your back, given the fact that I am unable to update to 9 or a version from portableapps.com that is confirmed working, but I definitely appreciate the support.

No problem. If necessary, I can always get F6 Portable, and run it simultaneously.
But the prefs.js file, and display of NS GUI, shouldn't really be all that different from 6 > 9.

And you're very welcome.

ETA: No big deal, but we have a habit here of breaking links, either by messing up the protocol or prefix - http// (no colon) www dot somesite.com -- or wrapping in code tags, as I did. (Much faster when there are multiple links, as in this case.) I know *you're* not a spammer, but it prevents even the slightest suspicion that someone is posting a bogus issue just to get their link posted, search-engine optimization, etc. -- or non-savvy users clicking what might be an unsafe link. Etc. No offense or chastisement intended; just letting you know why this was done with your list. Again, SOP. Cheers.

[Neil_McCauley]

Hi Tom, as usual thank you for the stellar post. I will probably continue with my testing, give you a proper reply, and post my results on Monday. If you do not hear from me this weekend, it does not mean that I forgot about you! Your time is appreciated; Thanks again.

-Neil

[Tom T.]

You're very welcome, Neil. Have a great weekend, and we'll talk next week or whenever.
- Tom

ETA: Now, you're on Fx 3.6.13? Give me back that beer! ... at least update *that* to 3.6.25!

[Neil_McCauley]

Hi Tom,
I did have a good weekend. I hope you did as well.
I don't have a complete answer yet, but I have more information to add:
I renamed the folder Profile to Profile_old and Mozilla automatically created a new profile when I launched it. This new profile has no extensions pre-loaded. I added only NoScript and the problem persists so we can rule out the other two extensions as possible conflicts.

I compared the good prefs.js to the bad prefs.js and here are the major changes. Original document: good prefs.js file and these were the modifications made to the good prefs.js:

Deleted: about:addonsabout:blockedabout:certerrorabout:configabout:crashesabout:homeabout:neterrorabout:pluginsabout:privatebrowsingabout:sessionrestoreaddonsa

Inserted: addons about:blocked about:certerror about:config about:crashes about:home about:neterror about:plugins about:privatebrowsing about:sessionrestore addons.

Deleted: chrome:resource: about:addons about:blocked about:certerror about:config about:crashes about:home about:neterror about:plugins about:privatebrowsing about:sessionrestore chrome: resource:");

Inserted: chrome: resource:");

Change: user_pref("extensions.blocklist.pingCountTotal", X); where X was changed from 3 to 4
Change: user_pref("extensions.blocklist.pingCountVersion", X); where X was changed from 3 to 4

Inserted: ABE.migration", 1);
user_pref("noscript.gtemp", "");
user_pref("noscript.options.tabSelectedIndexes", "1,0,0");
user_pref("noscript.p

Inserted: user_pref("noscript.subscription.lastCheck", 908557981);
user_pref("noscript.temp", "");

I'm not sure if this helps, but there may be something in here that you see that I do not. I will try and answer the rest of your questions after performing more testing.

Warm Regards,
Chris

[Neil_McCauley]

Hi Tom,
Just to update you. I enabled Firefox Sync on my portable Firefox today and everything seemed to work okay. My instance name was "Neil's Awesome S200 Firefox instance." After closing Firefox and going back into Firefox Sync settings, my instance name changed to "Neil'sAwesomeS200FirefoxInstance." This appears to be a problem with the portable Firefox deleting spaces in the prefs.js file and not something specific to NoScript.

-Neil

[GµårÐïåñ]

In general its a good practice to NOT use names that have spaces in them. Unfortunately since Windows 95+ and Mac have become commonplace, it has been allowed and has caused bad habits among people using spaces in their file, path names, and you really will run into trouble with it in any TRUE technical environment, specially Unix/Linux systems. If you must keep the words separate, which I do all the time, use _ as your space.

So: I love noscript.ext becomes: I_love_noscript.ext and you are immune from any whitespace redaction performed by ANY system.
If you are working with a path: /path/to/i love noscript becomes: /path/to/i_love_noscript

and this small change in your naming habit will protect you against much grief in the long run, I promise you. Not just in this case. In addition, try avoiding special characters in names/paths (and no _ [underscore] doesn't count as its one of the few allowed ones in almost all systems) such as ~!@#$%^&*()+?/\| as they often have reserved function values that could throw a monkey wrench in the case of a bad or poorly written and error checked code environment. Basically take some steps to protect yourself and don't always count on the developer to be smart enough to error check for you.

NOTE: None of these comments are in any way related to how NS works and this issue is obviously not a NS issue, so these comments while SLIGHTLY off topic, address the OP follow comments and could be helpful.

[Tom T.]

Hi Neil/Chris,

Sorry for the delay. Making a living, and all that.

Everything is pointing to an IronKey issue - you don't have such problems on a standard install of Fx, or a portable install on a non-IronKey flash drive, right?
Did you ever check with IronKey support?

Did you try temp-allowing some sites, and seeing how they appear in the whitelist, as suggested a few posts ago?

The spaces in prefs.js are automatic, but something is removing them. Try to reproduce the issue with a portable on a standard flash drive. I think you can get legacy versions from PortableApps, so you can test 6.0.

With all due respect to my very good friend GµårÐïåñ, if spaces aren't allowed in a name, the program should say so.
File paths or file names with spaces in them work fine in Windows command line if you wrap them in quotes. But Firefox is an entity unto itself, and the about:config and prefs.js formats call for spaces as separators, as opposed to, say, commas, semicolons, etc.

Since no one else has reported this issue AFAIK, it really seems to point to IronKey, especially if you can't reproduce it with the same extensions and F6 on a standard flash drive. Looking forward to those results.

[pbrumb0323]

Hi Everyone,

I've been following your discussion here and I wanted to share with you further evidence that the issue points to Firefox on IronKey.

I'm using an IronKey D200 (software version 2.5.1.0, firmware version 2.0.13), on it is Firefox (version 11.0). I recently installed an extention called FEBE (Firefox Environment Backup Extension, version 7.0.3.2) - the tool essentially is used to backup and restore extentions, themes, and other settings. In FEBE, I set the backup destination directory with a name that contained a space. On the initial run after FEBE setup, the backup worked properly - but after closing and later on starting FF, within FEBE the space had disappeared from directory name, and consequently the backup failed because the directory name (without the space) could not be found.

I repeated the test with identical results on both Windows 7 Enterprise SP1, and Windows XP Professional SP3. On normal installations of Firefox (on both OS), FEBE settings that contained a space (as well as the NoScript Whitelist) were not altered.

I hope this helps!

Regards,
Bryan