Hacker News Reader

Comment by dewey | Hacker News Reader

In case you don't have Tor installed and want to know what it looks like: https://imgur.com/GbwKfuG,D2aWi25,glApNg3

Very refreshing to see a big, red warning in the screenshot about the fact that Javascript is enabled! Usually you see the same thing when Javascript is disabled, asking you to enable it.

(SecureDrop dev here) Glad you like it! It's hard to tell people who get excited about fun UX ideas that they can't use JS, but from my experience as a browser security engineer, eliminating JavaScript (and plugins, which the TBB does already) dramatically reduces the browser's (unfortunately enormous) attack surface.

Agreed with you completely. Every time a new web app is posted to HN and it doesn't work without enabling Javascript, a small circle of security-conscious people complain about it. The responses from other people are in the lines of:

"Are there really people that browse the internet without enabling Javascript in 2014?"

"Well, 0.01% of your users have Javascript disabled, you can safely ignore them"

"Javascript is an important part of the web, if you have it disabled, you have no right to complain"

We need more people like you to advocate secure browsers without using Javascript.

In August 2013, the FBI injected a Javascript exploit with a MITM attack to uncloak the real IP addresses of people accessing Silk Road over Tor: http://arstechnica.com/security/2013/08/attackers-wield-fire...

[edit] Nerdier link with exploit demo: http://resources.infosecinstitute.com/fbi-tor-exploit/

Reply on news.ycombinator.com