NoScript Plugin: Simple Instructions

Firefox Noscript plugin 10.1.5.9 trust a site. Note that I hit the large S for google.com and now it says trusted. The large clock means it is temporary and will be removed when the browser closes.

NoScript 10.1.5.9 is a web browser plugin for Firefox that allows you to control what javascripts run on your browser. I find it a very effective tool that really does a good job, but was initially most discouraged because the instructions were complex and the tool is not so user friendly. This is a simplified set of minimal instructions that will get you started. If you need more than the basics then go read the complete official instructions.

Why use NoScript?
Certain web sites are getting pretty sophisticated with their javascript. One Canadian news site, for some reason, disabled their right mouse button function and instead coded this action to a left mouse button click. All this javascript manipulation has many unintended usability consequences that I did not want to tolerate. Instead I opted to more personally control the javascript that is executed in my browser using NoScript.

I am sure that there are other security reasons to use NoScript, as this is a standard plugin to the Tor Browser. By limiting the various sites that might inject code into a web site, cross site scripting vulnerabilities are more controllable. Read the full instructions for more info.

Using NoScript as Default: No Javascript
By default, NoScript loads the site but turns off all javascript. There are a lot of very suspect sites out there that use javascript to trick you, or find a vulnerability. While the default no javascript setting may allow a site to appear, depending on how the site was coded, some or all actions may not work. For example the site might display a completely blank white screen, might partially load or might not display correctly. This is the safest. If you only wish to read their content, then you really do not want any action anyway.

NoScript plugin: default no javascript will run.

If you wish to allow some type of action on their site you have two options:

1. temporarily allow all javascript to run, you somewhat trust the site
2. temporarily allow some sites’ javascript to run
3. permanently allow some sites’ javascript to run

Temporarily Allow All Javascript to Run
If you infrequently visit a site but believe it is safe, you can click the NoScript icon in the toolbar. The NoScript list for the web page will appear. Click the clock with the exclamation point for “Temporarily allow this page”. The NoScript icon on the toolbar changes from a blue “S” with a red strike out symbol, to a blue “S”. Note that all web sites on the page will run until you close your browser, after which these sites’ javascript will be blocked. Click the green circle arrow to reload the page.

NoScript Plugin: Grant all temporary access. The large clock, and not the small clock, means temporary. Restart your browser and access is denied.

If you see any of these other sites from previous pages used in subsequent browsing on other sites, you can turn them off if you wish. All these sites will be blocked once you restart your browser.

Temporarily Allow Some Javascript To Run
If you somewhat trust the site, you could only allow specific sites’ javascript to run temporarily, but not the javascript from the whole site. For example, the site hackademix.net loads javascript from itself, hackademix.net as well as Google.com. If you wish to only allow hackademix.net to temporarily run javascript but not Google, you can click the large blue “S”. The display will change from the default of no script running, the blue “S” with a red diagonal bar through it, to the blue “S” Trusted, with a large clock. The large clock, vs a small clock, means temporary. Hackademix can run temporarily run javascript, but not Google.

NoScript Plugin: Temporary access for a specific site, but not for Google. Note the large S Trusted. The large clock, and not a small clock, means temporary.

In this case hackademix cannot run javascript but Google can temporarily run javacript.

Firefox Noscript plugin 10.1.5.9 trust a site. Google can run javascript but not hackademix.net. Note that I hit the large S for google.com and now it says trusted. The large clock means it is temporary and will be removed when the browser closes.

Permanently Allow Some Javascript to Run
For your sites you regularly visit, you will want to allow them permanent access. In order to change from temporary to permanent access, click the clock. The clock will change from large to small, denoting permanent access. This permanent setting is stored in your browser database, and will be retained the next time you start your browser.

Google gets temporary access to run javascript. Note the large clock. Restart the browser and Google no longer has access.

Firefox Noscript plugin 10.1.5.9 trust a site. Note that I hit the large S for google.com and now it says trusted. The large clock means it is temporary and will be removed when the browser closes.

Google gets permanent access to run javascript. Note the small clock. Restart the browser and Google still has access.

Firefox Noscript plugin 10.1.5.9 trust a site. Note that I hit the large S for google.com and now it says trusted. Click the large clock and it will turn into a small clock, which means it is now permanent and will be retained when the browser closes.

Save your Preferences
From Addons Manager, NoScript, Preferences, NoScript Options, the top right has an option to export preferences. This will save a .txt file to your computer. I have exported my preferences but have not imported them.

Why Go to all This Trouble?
Some sites do some very strange things with javascript. If you wish to block these bad user interface choices, NoScript will give you the tools to block specific actions but not others. You will need to learn, site by site, which NoScript setting are appropriate, and can permanently store what you need. NoScript blocks malicious javascript by default, so if you forget, NoScript will protect you and your computer.

Javascript will only get more sophisticated over time, so a tool such as NoScript under your control is necessary for safe browsing.