Script-blocker NoScript lets in ANYTHING from googleapis.com

If you use it, need to read up...

[tangor]

Detectify security researcher Linus Särud has reported a weakness in popular Firefox security tool NoScript that allows attackers to have their malware whitelisted.

The tool is used by some two million security-and-privacy-conscious folk who want to stop active content like JavaScript and Flash getting a foothold in their browsers.

Such folk will be disappointed to learn that Särud (@_zulln) says attackers could upload their net menace of choice to any free Google subdomain and have it slip through NoScript's defences.

[theregister.co.uk...]

Clear you whitelistings, kiddies. It's not difficult, but is a PITA to have to do it in the first place.

[Leosghost]

I never whitelist anything, ( permissions are given on a page by page visit by visit basis ) I'm amazed that anyone running NoScript would..

You can never know what has happend to any site since the last time you opened a page from it, or what might have happened to any any "source" or domain..

I agree with the comments there ( el reg ) about self hosting jquery etc, why depend on a 3rd party hosting scripts in order to have your site functional ..and also agree re the "non whitelist including" forks of adblock and other blocking tools..

Of course one can build pages and sites that don't take the easy ( but vulnerable way out ) and not use all the "bells, whistles, "bling" and "buttons" from "elsewhere"..

Self hosting scripts, and not including all the in/on/code/page links to 3rd party "bling" providers, also throws a spanner in the 3rd party providers silent "track your visitors" activities too..thwarting them is not "a bad thing" :)

Hell, I even visit my own domains with NoScript et al running in full lockdown mode..;)

[bill]

Whitelists are handy for NoScript. I'd spend half my day authorizing sites I frequent otherwise. Running NoScript without anything approved would drive most people nuts. Although I do agree that this is a good opportunity to wipe them all and start over.