Opened 4 months ago

Closed 4 months ago

Last modified 4 months ago

#31096 closed defect (wontfix)

Tor Browser missing NoScript on Linux/Ubuntu version

Reported by: torlove Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Tor Browser 8.5.3 on Ubuntu (version unspecifiable) is is missing the NoScript icon in the top right. Therefore the only way to enable and disable JS is on a global scale by clicking the shield and then "Advanced Security Options".

(On the side, most of the time the transmission rate is a crippling 2kbps, or not existent. Occasionally the transmission rate is what I have come to expect on Tor. The problem is unique to Tor. I have tried transmissions with other programs in Ubuntu and they pass large volumes of data fast.)

Child Tickets

Change History (5)

comment:1 Changed 4 months ago by gk

Component: - Select a componentApplications/Tor Browser
Owner: set to tbb-team
Resolution: wontfix
Status: newclosed

That's the way you are supposed to enabled/disable JavaScript. If you want to have the NoScript UI back, just customize your toolbar and put the icon back onto it.

Version 0, edited 4 months ago by gk (next)

comment:2 Changed 4 months ago by torlove

The icon was never there in the first place. Whereas it is for other implementations that I've seen. This in theory could create a fingerprinting problem based on the os? (Yes I know that using NoScript may create it's own fingerprinting problem).

Is NoScript being dropped from the toolbar?

comment:3 in reply to:  2 Changed 4 months ago by gk

Replying to torlove:

The icon was never there in the first place. Whereas it is for other implementations that I've seen. This in theory could create a fingerprinting problem based on the os? (Yes I know that using NoScript may create it's own fingerprinting problem).

No, websites don't have access to the toolbar. So, it should be fine whether you have or have not icons on the toolbar.

Is NoScript being dropped from the toolbar?

Yes. For the full proposal behind this, see: https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/101-security-controls-redesign.txt

comment:4 Changed 4 months ago by torlove

Thanks for the link to the resource, gk. It is a good document, whatever we can do to make things easier for beginners is good.

There are two items discussed in the resource above that have not been done.

1) Educating the user about the changes.

Although it was not part of the scope of the document the author clearly states that this is an area that requires attention. It is important to tell users of impending changes, and to inform a user when a change is implemented. The home screen is the best place to do that.

2) Moving per-site js permissions (NoScript) too the URL bar:

In my opinion, NoScript should be moved to the URL bar to the right of the "Toggle Reader View" button. The icon should be one that suggests code or scripting, either:

a) a tiny backslash inside angled brackets, or
b) the standby/power symbol (https://www.symbols.com/symbol/standby-symbol), or
c) a gear icon with JS written lightly inside.

Alongside the icon should be a small tag with the number of js domains blocked having a strike-though. The number of approved js domains used by the page would not have a strike-though.

NoScript needs to continue being one click away because when a page/document loads and the JS is blocked there is no way to re-trigger the page load event. So there are times when the user must access NoScript after multiple page load events. Typically two page loads are needed, but I have seen websites where five page loads are needed. The user needs to repeat this process for a domain every time they restart Tor browser.

In the interests of educating the user, after restarting the browser we might inform the user that editing the permissions may make fingerprinting easier. Especially if you repeatedly use the same settings.

Is there an open ticket where these suggestions can be placed?

comment:5 Changed 4 months ago by torlove

Furthermore, in terms of simplifying the toolbar, the 'three dot icon' is redundant. The three options a user gets is:

  • Bookmark this page (the user already has a bookmark button)
  • Copy link.
  • Email link.

None of these options add value, I'd much rather dedicate the space to the NoScript icon and subsequent tag.

BTW I've added these UI suggestions to two other tickets relating to this subject, the main ticket being:
https://trac.torproject.org/projects/tor/ticket/30570

Note: See TracTickets for help on using tickets.