How Important is Nonfree Javascript?

Do you run nonfree JS or any JS at all in your browser? Do you even think it matters?

For me freedom and privacy is something you gain bit by bit. When I tried to do it all at once I wasn't able to keep up. When it comes to non-free JS, I'm not there yet. I'm not sure if I'll even try aside blocking worst offenders.

>>5777 I use uMatrix and disable all JS by default, free or non-free. I'll only enable it when I really want to access a page that doesn't load without JS and when that happens I make sure to only enable the smallest number of scripts.

>>5780 Same here, and I'm not even that technologically capable myself. I have everything disabled by default and when a site I trust isn't working because of it I just temporarily allow scripts one by one until it does, and when I open my browser the next day the process starts again.

>>5780 The problem with that is that your browsing history is saved in a way because your whitelist tells a lot about your browsing habits.

I run Qubes with predefined browser set-ups that access Internet over several VPN servers around the world. Every instance is for it's own purpose like social media accounts, pseudonymous forums and study. I post on imageboards over Tor because it's the only way to achieve full anonymity and many people like me do so, if an imageboard blocks exit nodes, i put a fresh proxy after it. I do not disable JS because it is in fact a very clear red flag, a bit of identifiable information from user. Unlike Tor browser usage that strictly implies it's users to turn off javascript and not fullscreen it's window, ordinary websites expect your ordinary web browser to have JS turned on by default. I do use adblocker with most basic lists for my language and territorial range, again more lists on adblocker = more identifiable info. I spoof audio fingerprints, clear cookies and caches from volatile sessions and obviously keep them for non-volatile ones. Some of my browser profiles have custom themes and addons installed, though they are only used for a small range of websites I need modified functionality for.

>>5782 What's the issue with having a browsing history though? I only use software that I trust. Linux, Firefox, uMatrix aren't going to share my uMatrix profile with anybody. >>5795 > I do not disable JS because it is in fact a very clear red flag, a bit of identifiable information from user [...] ordinary websites expect your ordinary web browser to have JS turned on by default. There's no way to know whether you have JavaScript turned on or off though. You download an HTML page and that's it. Sure, a website owner could rig his servers to track which ip downloads the HTML file but not the associated JS files, however the JS files would have to be on a server owned by the same person (so say goodbye to CDNs and the like) and the amount of generated data would be far too much for anyone to handle. Sure, big players such as Google or Amazon may be able to do it, but even then: it's easy to avoid them and if you do use their services, it's impossible to tell the reason why you didn't download the file. There are many possibilities: - You didn't download the js file because you didn't want to (uMatrix). - You didn't download the js file because you accidentally download the HTML file and stopped the page from loading. - You didn't download the js file because you're a bot scrapping web pages. - You didn't download the js file because your internet connection is flaky. - You didn't download the js file because you're using a cli browser that can't execute js. I'm pretty sure there are many more reasons for downloading an HTML file but not its associated js files. There's nothing fundamentally identifying about it, even if the website owner decided to track who downloads HTML files but not the corresponding JS files.

I use Tor for almost all web browsing, but there are a few irl-related things I need to enable non-free javascript for and not use Tor. For those occasions I use firefox with umatrix.

>>5796 >There's no way to know whether you have JavaScript turned on or off though. You download an HTML page and that's it. Dude, don't just make stuff up. https://www.facebook.com/ >JavaScript is disabled on your browser.

I personally use noscript wherever possible. >>5799 The code that checks if your javascript is disabled is usually ran on your browser. Not on someone elses server. A big part of why Javascript is so bad is because it is browser side.

>>5796 There is a <noscript> html tag and many websites display "Please turn on Javascript, cookies and your telescreen" because they have a server-side detection. It's not a big deal, google it yourself. >You didn't download the js file because you didn't want to (uMatrix). Not that many people use uMatrix, filtering proxies, hosts lists or any kind of browser-based firewall, it's mostly big organizations/businesses and tech-savvy placebo paranoics from imageboards like you. Websites can even detect if you are using a certain type of ad blocker. >You didn't download the js file because you accidentally download the HTML file and stopped the page from loading. They know who does it and how often. People don't stop downloading pages that often for me to blend in. >You didn't download the js file because you're a bot scrapping web pages. I am clearly not a bot since my page behavior and posting style are human and I am not scraping pages in bulk. >You didn't download the js file because your internet connection is flaky. It would download eventually, most of the time user will reload the page just to get full page functionality with JS. >You didn't download the js file because you're using a cli browser that can't execute js. If you sum all noscript, umatrix, cli browser users, add flaky connections and accidental page loading stutters you won't even get 1% of all web users, and if you look closely from server side, you'll be able to digest them even better with ip addresses, tcp fingerptints, user agents, individual behavior.

>>5802 >There is a <noscript> html tag and many websites display "Please turn on Javascript, cookies and your telescreen" because they [don't] have a server-side detection. It's not a big deal, google it yourself. And what happens when the <noscript> tag contains an invisible iframe? Do they know you disabled JavaScript then?

>>5810 Not if you block frames too... Hell, you could filter out the no script tag if you wanted.

>>5812 >Not if you block frames too... Hell, you could filter out the no script tag if you wanted. Do you do that? What about JS timer to ping the server? If the server does not get the ping either you closed the webpage faster than possible or you have JS disabled.

>>5810 <noscript> tag is client-side. It is used to either display a message of disabled javascript or redirect to non-js page. The detection is done server-side with socket pings or simply guessing whether you downloaded the js file or not.

>>5816 >Do you do that? ....yeah. it's not hard with umatrix. obviously there are ways to figure out if a client is using javascript or not. you could just have it ping the server with an xhr as soon as the page loads. i don't know why anyone would bother with all this for fingerprinting purposes though.

>There's no way to know whether you have JavaScript turned on or off though. You download an HTML page and that's it. So what >>5796 meant was There is no way to you have JavaScript turned on or off before your browser renders the page?

>>5833 Not that lainon, here, I don't quite get your question, but anyway, regarding statements of those who stubbornly repeat that there's no way for the server to know if JS is being executed or not, client side - it's bullsoykaf, because JS often does fetch much more data from the server than your browser otherwise would, or interacts with the server in other ways. Now it's only a matter of checking for presence or absence of that activity associated with scripts. Or, as someone else already soberly pointed out >>5816 - you can write a function in it, whose sole function is to make such checks.

>>5799 This is all done in HTML. Your browser decides to display <noscript> tags if javascript is disabled. If it isn't, the noscript tag isn't displayed. >>5802 >I am clearly not a bot since my page behavior and posting style are human and I am not scraping pages in bulk. We have different behaviors then. I don't interact with web pages, I merely read the data. >It would download eventually, most of the time user will reload the page just to get full page functionality with JS. I disagree. An example would be browsing while in the subway. Your internet connection can be quite flaky in there. >you won't even get 1% of all web users [citation needed] >>5810 uMatrix can block iframes but even if it didn't, uMatrix doesn't render noscript tags. >>5816 >What about JS timer to ping the server? See all the possible scenarios I mentioned in >>5796 . >>5833 I don't understand your question but here's how a browser works : - You give it the URL of an HTML file - The browser downloads the HTML file - It parses the HTML file - Then, depending on how you configure it, it will fetch other documents (css, images, javascript...) - In the meantime it starts rendering some of the HTML elements of the page and finishes rendering everything when all the documents are downloaded. Your browser doesn't send an HTTP flag to the server to tell whether you have JavaScript enabled or not, it would serve no purpose. >>5842 >repeat that there's no way for the server to know if JS is being executed or not, client side - it's bullsoykaf No it is not. When a browser doesn't follow the standard procedure, it could be for any of the reasons mentioned here : >>5796 .

>>5795 so correct me if i'm wrong here... but are you saying you think that blindly running every bit of javascript you encounter is less of a risk than the (to my knowledge widely unused) possibility of fingerprinting based on noticing that you aren't executing any javascript? last i checked there were active exploits for discovering your gateway IP with js using web sockets. maybe they've been patched by now, but the possibility of another exploit like that isn't exactly remote. that's not even considering the hoops you'd have to jump through to evade the google analytics dragnet while keeping everything normal-looking from their end. i think you'd be better off setting up your browser so that you look like a search engine crawler or something from the server side. that way you don't stick out and you don't have to run js (the implication that you're a bot would hopefully excuse unusual behavior on the client side).

>>5850 also, i'd like to point out that if you're using tor, you don't actually have to blend in with the rest of site X's visitors. if they backtrace your ip and hit a tor exit, they know youre using tor. seems like it'd be pretty easy to keep track of you if you're the only tor client not using the browser bundle default config. wouldn't it be a better idea to try to blend in with the other tor users who you are potentially sharing an IP with by simply running the tor browser with default settings?

>>5848 >I don't understand your question but here's how a browser works : I'm trying to create an explanation for >>5796 instead of just saying it is wrong and somehow now I'm the idiot instead of >>5796. >active exploits for discovering your gateway IP with js My gateway IP is 192.168.0.1

>>5848 Lainon, i've read that, but those cases still do stand out from the typical situations, where scripts get fetched, and ran. No matter which of those reasons is true, this doesn't deny what i've said - it is still feasible for the server side to tell whether scripts have been executed or not.

>>5848 >I don't interact with web pages, I merely read the data. You eventually click hyperlinks, this is what web is made for. Bots don't click links same way humans do. >Your internet connection can be quite flaky in there. Sad thing, not everyone lives in third world. People usually don't use their laptops in subway either. >[citation needed] There are around 2% of web users using GNU/Linux. Text-mode browsers are used only by arch babies when their x server breaks, there are 70 000 uMatrix users and there are around 2 million NoScript users. Out of 4 billion web users overall. Even if you look at statistics for websites based around tech-savvy audience, not that much of their users turn off scripts too. >When a browser doesn't follow the standard procedure Is a fingerprintable condition. Because most browsers follow the standard procedure. >>5850 >there were active exploits for discovering your gateway IP with js using web sockets Virtual machine is not aware of any gateways, it is behind software NAT. Here's my IP btw: 127.0.0.1 :) >evade the google analytics dragnet while keeping everything normal-looking from their end. You know what doesn't happen when you connect to Google with ungoogled Chromium or Firefox fork without telemetry? That's it. This is why your "privacy" settings are mostly placebo. >i think you'd be better off setting up your browser so that you look like a search engine crawler or something from the server side. Search engine crawlers don't have residential IPs, they don't visit your site from subway or from commercial VPN services. >>5851 I guess, Whonix was developed specifically for this purpose to run Tor Browser without a a hassle of dealing with Windows logging, badly configured firewalls and Selinux bugs, it just werks out of the box. With normals infestation on Tor as a "hip" way to buy and sell skooma, most "deepweb" sites and forums turned into flat hipster garbage refusing to work without javascripts. You have a choice of not visiting them though, since there is non-zero probability of those sites being FBI/Interpol honeypots.

>>5864 You're right. Re-reading our exchange, I see we're talking about different things. I was saying that it's not possible to tell whether you have javascript turned on or off and I'm right because of the reasons I mentionned. You're saying it's possible to know whether the client executes JavaScript or not and you're right since you can just send an XHR. I misinterpreted your message since you were answering to my message, I thought you were claiming that it is possible to know whether JavaScript was on or off. >>5866 >You eventually click hyperlinks, this is what web is made for. Bots don't click links same way humans do. On the contrary, bots have gotten closer and closer to human behavior in order to not raise suspicions when crawling websites. >There are around 2% [...] turn off scripts too. You're not taking all the other reasons I mentioned into account. >Is a fingerprintable condition. Because most browsers follow the standard procedure. I agree, it's a fingerprintable condition. However, JavaScript provides many other fingerprinting techniques and those offer far more granularity than being able to know that the client that just downloaded your HTML page didn't download one of the JS files it links to. >Virtual machine is not aware of any gateways, it is behind software NAT. I think what he was talking about is how webrtc can bypass some VPNs, like this : https://security.stackexchange.com/questions/105128/how-does-webrtc-bypass-a-vpn-tunnel

>>5867 The original poster said he uses Qubes. As I know, Qubes runs every graphical application inside it's own virtual machine complete with kernel and X server stripped down to purpose of running single application. You can replicate virtual machines unaware of their real IP the same way as if you are running VPN client on your router, unless the browser exploit is aware of such things which looks more like a targeted attack, and we are discussing passive massive surveillance matter here. >However many VPN configurations don’t properly disable local interfaces Well, here's the thing. "Secure" today means "properly configured". VPN was never designed for what it is used these days, so certain implications should be taken in mind. For most stuff, proper firewall and MAC rules would eliminate 99,99% of browser exploits.

Read this just now. Apparently you can replay the user session from a visit back with horrifying accuracy. https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts/