Selective javascript

Question

Is there a way to selectively load javascript on a javascript dependent site, such that the site still functions but cannot track you through it?

If not, this would be an excellent research topic.

If there is, it would be an excellent addition to any browser.

Answer 1

Noscript allows this functionality, you can go into it's settings and enable fine grained control of what scripts are and are not allowed.

However this is not recommended, for a couple of reasons.

First of all, trying to classify good/bad scripts is always going to have failure cases. Any attempt to classify scripts as benign or malicious based on simply their path will fail. The attacker can, from the same location, serve one script one time and a second script the second time. Any attempt to classify on content will fail, it would either require manual re-analysis for every possible version of some popular javascript library, and every possible minification of it and any attempt to automatically analyse scripts for bad content will fail, due to the halting problem.

Second of all, it's possible for javascript to tell which javascript is loaded, by for example checking to see if some variable or function that is defined in some other script has been set. By doing this, any script loaded into any site can tell what scripts you have or have not been allowed. Since there is, as mentioned in part 1, no meaningful way to determine if a script is or is not good or a source is or is not trustworthy the user themselves would need to create this list from their own preferences (giving users choice to create their own security choices and preferences is almost always a fatal mistake) the set of what scripts a user would or would not load would constitute a fingerprint, while possibly not unique it would make you less anonymous. The set of other Tor users that you may possibly be would be greatly reduced. A malicious set of conspiring websites could use similar techniques to track the user across site and sessions. By feeding the user a "tainted" script and having them whitelist it, it would be possible for a third party site to get the user to try to load the set of all possible tainted scripts and identify the user based on which of the scripts they have allowed.

As such, for the best anonymity properties keep scripts disabled and enable them only when you need them, by toggling allow globally or forbid globally.