Security and Javascript

[FranklyFlawless]

@redline

My question is, is there a preferred method to allow for javascript (to prevent site breakage), but also maintain the best privacy, security, and anonymity as you can when allowing javascript. The context of this question is mainly pertaining to clearnet browsing and for use of things such as email and account services on .com/.onions (of trusted sites).

The Security Level is the preferred user-friendly method to configure your security and anonymity, and out of the three options, two are relevant to your question:

• Standard
• Safer

Standard has all browser and website features enabled for maximum compatibility, while Safer changes these settings:

• JavaScript is disabled on non-HTTPS sites.
• Some fonts and math symbols are disabled.
• Audio and video (HTML5 media), and WebGL are click-to-play.

Focusing on only the first point out of these three, this makes your question easy to answer:

• On websites that serve mixed content, use Standard.
• On websites that only use HTTPS/HSTS, use Safer.

@redline

I have seen that some change noscript settings by utilizing temporary whitelisting of domains, my understanding is that temporarily whitelisting domains helps reduce fingerprint considerations as compared to if one was to permanently whitelist domains (I assume this is because certain site scripts can see which domains you are blocking and allowing)?

No, (temporarily) whitelisting domains only means one thing: trusting its code.

@redline

I have also seen some who after utilizing the “safest” security level go in and manually change the Javascript setting in about:config, as it seems that Javascript shows “enabled” in about:config even though it’s not (due to “safest” security level), is this a step that is actually necessary? Tor does not mention this in their literature.

It is not. Additionally, editing about:config can lead to deanonymization.

Does anyone here use the "Onion Live" Addon? I need help with this issue

It is not a file and the spelling is incorrect. It refers to the Configuration Editor used in Firefox-based browsers. You can access it by typing about:config in the address bar. I suggest being especially careful about changing settings in the Configuration Editor, as it may cause deanonymization.

@redline

Or does it not really matter and what’s more important is knowing when you should and should not use javascript depending on your threat model?

Absolutely correct.