Cannot use NoScript with Tor set on Safest Mode

Question

I have set Tor to "Safest" which disables all JavaScript, which is fine, as long as I can allow certain sites/scripts to run with NoScript when I need it. However, NoScript is not working for me. When I set a site/script to "Temporary TRUSTED", nothing is happening. If I go to https://protonmail.com/signup, ProtonMail will complain that needs JS to work, and if I allow it in NoScript, nothing happens. I have checked the "Trusted" checks and I have tried toggling the NoScript "Override Tor Browser's security level preset" on and off.

Now, it seems that is working to me if I set Tor to "Safer" and uncheck the NoScript "Default" settings to allow less items to be loaded, this seems the safest option to me, as otherwise I'd have to use another browser. If "Safest" only difference is to block JavaScript, then I can live with this.

p.s.: protonmail test was only a JS test, I know some ppl are against logging into personal accounts in TOR.

Is there something that I'm missing to work with "Safest" and allow JavaScript to work on specific sites?

Thank you!

Answer 1

This is a temporary change in the latest Tor Browser version (9.0.7) due to a Firefox vulnerability.

https://blog.torproject.org/new-release-tor-browser-907

In addition, this release disables Javascript for the entire browser when the Safest security level is selected. This may be a breaking change for your workflow if you previously allowed Javascript on some sites using NoScript. While you are on "Safest" you may restore the previous behavior and allow Javascript by:

• Open about:config
• Search for: javascript.enabled
• The "Value" column should show "false"
• Either: right-click and select "Toggle" such that it is now disabled or double-click on the row and it will be disabled.

We are taking this precaution until we are confident recent NoScript versions successfully block Javascript execution, by default, by working around a Firefox ESR vulnerability.