Opened 6 months ago

Closed 6 months ago

Last modified 6 months ago

#30613 closed defect (worksforme)

Noscript button disappeared in 8.5

Reported by: cypherpunks Owned by: antonela
Priority: High Milestone:
Component: UX Version:
Severity: Major Keywords:
Cc: antonela Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

The NoScript button disappeared in the new TBB in macOS.

Tried removing all Tor related files -not just the app but running

rm -rf ./Application\ Support/TorBrowser-Data/
rm ~/Library/Preferences/org.mozilla.torbrowser.plist

Which should result in a clean install, still no NoScript icon.

(I re-downloaded and reverified the binary prior to reinstallation)

Some prefer to whitelist certain sites.

Ex: someone browsing Reddit may allow Reddit, but not want every random site reddit links to running JS.

This is basically undoable w/o NS icon - and right clicking and clicking "noscript" in the context menu on a web page only brings up the noscript menu if the icon is present in the task bar.

Since I am not clear if this is a defect on my end I'm not sure where the "proper" place to put the icon back is, and fear if I add it it will decrease anonymity - either through being able to fingerprint the length of the address bar, or alternatively if a poorly redacted screenshot is shared, it leaks my specific config'd browser was source.

Please investigate this error and allow a *usable* way for users to whitelist JS with more granualarity than all or nothing.

This error exists to my knowledge in TBB 8.5 running on macOS 10.14.5 but may extend to other operating systems

Child Tickets

Change History (2)

comment:1 Changed 6 months ago by gk

Resolution: worksforme
Status: newclosed

You are free to add the icon back to the toolbar. There is no way known that website content is able to read anything from the toolbar, thus I think we are fine from a fingerprinting point of view.

NoScript being still visible in the context menu is actually a bug we did not fix yet, which is unfortunate, see: 29886.

The vast majority of Tor Browser users will still have the old buttons available as an update from Tor Browser 8.0.9 to 8.5 does not remove them. What we do is inserting the Torbutton icon and the new security slider icon next to the URL bar. Thus, it should be easy to insert the NoScript icon back next to them. (But be aware that the HTTPS Everywhere icon is gone as well and won't come back, so if you want to blend in you might want to get that icon back onto the toolbar, too).

Meanwhile we try to schedule the remaining work for proposal 101 which should expose site-specific permissions directly in the browser, see: #30570.

comment:2 Changed 6 months ago by speedtester

I have to agree with cypherpunks, that removing NoScript buttons (for new installations) is not a great idea before implementing #30570, as it allowed better controls for exceptions.

And worth mentioning, that I (as an old user of tor) spent some time finding the cause of the missing buttons, I was about to open a bugreport, then I found this article. (didn't find the explanation in changelogs, or in the about:tbbtab)

Note: See TracTickets for help on using tickets.