5

I saw that NoScript + Firefox combination blocks all "dynamic content" (especially those spammy ads). I really like that. It reduces the chances of being exploited.

But, chrome only asks me to allow flash and some other plugins for some sites. It looks like FF + NS is much better than chrome.

Is that really the case ?

FirstName LastName
  • 1,489
  • 4
  • 19
  • 28

3 Answers3

6

For starters, Chrome has better security features and a larger security effort than Firefox.

It's true that JavaScript can be involved in exploitation and exploit kits use JS to hide exploits and profile the browser for exploitation. But disabling JS should not be considered a silver bullet for browser security.

More than just blocking JS, NoScript brings to Firefox security features which Chrome already has, like XSS protection. And features that Chrome lacks, like Clickjacking protection and protection against plugin based attacks. Take into consideration that NoScript will also increase the attack surface.

There isn't a clear winner here considering that the security of Firefox + NoScript depends on the user configuring NoScript and the usability trade-off.

For more about browser security read the Browser Security Handbook by Michal Zalewski. His book, The Tangled Web: A Guide to Securing Modern Web Applications extends this handbook.

Cristian Dobre
  • 9,797
  • 1
  • 30
  • 50
  • Please explain what this means - Take into consideration that NoScript will also increase the attack surface. – FirstName LastName Jan 13 '13 at 18:50
  • 3
    It means that NoScript is also a target for exploitation. As browsers get harder to exploit, attackers focus more on pluggins and addons. NoScript parses a lot of input so there are a lot of possibilities for buffer overflows and other attacks. – Cristian Dobre Jan 13 '13 at 19:04
  • So, its better to have "good" design and security built into the product itself rather than using a plugin ? That is, chrome's approach. – FirstName LastName Jan 14 '13 at 04:59
  • 2
    Right, the healthy long term strategy is to focus on a good browser design. A lot of browser insecurity came from browsers trying to do too many things for the user, like interpreting incorrect HTML. Plugins offer more flexibility and options for power users but come with risks. It is all a trade-off between usability, features, flexibility and performance. A wonderful book about browser (in)security is *The Tangled Web: A Guide to Securing Modern Web Applications* The technical parts of the book are "opensourced" in the Browser Security Handbook https://code.google.com/p/browsersec/wiki/Main – Cristian Dobre Jan 14 '13 at 06:57
2

I don't know the specifics, but Chrome goes through a great length to sandbox JavaScript, and to isolate one site from the others. That is unique among browsers AFAIK, making it very hard to exploit any vulnerability found in it (which do exist nonetheless). See this question for more info. Chrome is also one of the few that already supports iframe sandboxing, that should help making sites that embed third-party contents a lot safer (though I dunno how often that's used in practice, one well-known example is Facebook apps).

What's notable about NoScript, however, is that is allows you to selectively enable/disable JavaScript and other dynamic contents on a per-domain basis. That is also a unique feature AFAIK, since most browsers either allow you to disable all scripts in a page, or enable all them, no middle-ground supported. This allows you, for instance, to activate only the scripts necessary to access the desired contents, but leave all the rest disabled (in particular the ad scripts from wildly different sources that are usually present in a given page - and which represent a good percentage of the security risks).

That makes it hard to determine "which one is better". My gut feeling is that Chrome is better at protecting your computer, while NoScript is better at protecting the data you enter in the different sites. Since one can't reasonably expect every site out there to have decent XSS protection and to be kept up-to-date with the most recent attack vectors discovered, by minimizing the amount of untrusted code that runs in the same page context (something that Chrome's sandboxing can't do anything about) the chances of private data being leaked from one domain to another is decreased as well.

There are plans to port NoScript to Chrome, which I believe would be ideal, but unfortunatly it's been held back by the lack of support to synchronous access to the page assets by individual extensions. That means one can't inspect a script before it's already executed, making many of NoScript's features unfeasible (and also meaning alternatives such as NotScripts will never achieve a similar level of security).

Community
  • 1
mgibsonbr
  • 2,905
  • 2
  • 20
  • 35
0

The very same protection of NoScript in Firefox is available as "ScriptNo" Google it.

I would have provided a link but I am currently using Firefox and Google prevented me from accessing the portal where it resides without Chrome.

I change my browsers and use the most up to date one available all of the time, switching back and forth between Firefox and Chrome.

T I
  • 156
  • 2