Bonum Certa Men Certa

Your Bank and Other Web Sites Are Running Creepy JavaScript That Records Your Every Action

Reprinted with permission from Ryan

Your bank and other Web sites are running creepy “Session-Replay” JavaScript that follows you around the site recording your every movement.



You’re not “supposed to know” about this, but NoScript can block that from running.



I had a conversation with Matthew Garrett (alleged security person, actual drama bomb thrower) on IRC the other day about the “security” of JavaScript.



He had previously promoted it as a “great way of running untrusted code”.



Unfortunately, there’s just nothing secure about JavaScript. It’s the most widely abused platform in all of computing because almost everyone ends up running it without thinking of the consequences, and browsers which are instructed to do so, do it without bothering to allow any user control over the process in their default state.



If you can’t trust code, it’s better to not have it running at all.



Especially if it’s not doing anything to help you, and is proprietary.



Garrett said that “total sandbox escapes” where the program gets out of your browser sandbox and starts interfering with another tab or running arbitrary malicious code outside of any sort of confinement is “rare” to the point where someone would need to be “targeting you” and willing to blow a Zero Day exploit to do it.



That’s not exactly true as we see time and time again in the real world. But let us not hang ourselves up too long on what the Dalek of Social Justice has said.



If you drop a copy of O’Reilly’s book on Sixth Edition JavaScript from the kitchen counter, you’ll be walking with a limp for a while. Far from something that adds a little bit of “interactivity” to a Web page, JavaScript is a full blown computer programming language, Turing-complete, that can be used to write and run almost anything.



(I laughed the other day when I noted that someone had ported all of the LAME MP3 Encoder to JavaScript. It’s like, you could. But why? This is even dumber than online Office suites. People have spent years and lots of effort writing high performance encoding routines in C. Let’s make things worse and shove it to a Web server!)



Very little of what I do on the Web calls for something like JavaScript.



Nobody asked me if I wanted applications that run best on my computer, where I control them, where Big Brother is not looking over my shoulder replaced by some online version on someone else’s computer that I may or may not be able to access, and if I can, it’s watching what I do with it.



I don’t use Services as a Software Substitute where I can avoid it, and the ones I do use tend to be licensed under the GNU Affero General Public License, which makes them Free and Open Source Software.



If I don’t like someone’s Searx search engine, I can use someone else’s. If I don’t like a Matrix (protocol) chat server’s moderation, I can go use another one. If anyone wants to know what the source code does, or make their instance work differently, they can!



Web applications don’t have to be malicious. It’s just that many of them are.



In general, every way that Microsoft’s proprietary software could hurt you before is wrong with their Web applications, and then they’ve invented new ways of being nasty as well. So thanks, no thanks.



The people who invented the Web and the earliest browsers (such as Marc Andreeson, who said as much in 1994) wanted to keep it lightweight. The idea of JavaScript and even Cascading Style Sheets were controversial.



They knew that if these “features” were added, the consequences would be severe. And they are severe!



The Web has basically become Microsoft Windows. Bloated, fat, slow, and requiring a new computer every 4-5 years because of how painful things get. Features that are only useful to advertisers and marketers and spyware and other parasites being bolted on with no debate by Google and Microsoft, and tossed in by Mozilla and Apple “for compatibility”. Worse, it’s all impossible to secure and it’s rather embarrassing how complicated the standards are to get it to do much at this point. (There are starting to be chat servers implemented in GeminiSpace. But on the Web, you need to run a 600 MB tab for that!).



Worse, the Web rots. It’s become mostly a spam farm. Things disappear. Domain squatters come in. All your links go to a scam now. The entire thing has become so balkanized by megacorporations that come and go that if you use those “services”, every 10 years you have to figure out where all the people you used to talk to are.



We have to start backing away from standards that are hacked together by companies that won’t exist in a few years based on speculative business plans, many of which ought to be criminal.



Attackers take advantage of whatever they can.



They take advantage of poorly coded applications, gaps in security policy whether deliberate or accidental (some Windows malware includes the calculator from Windows 7 to get past User Account Control and evade virus scanners, for example), or software distributors like Apple which do not ship Web browser security updates quickly (giving the attackers time to study the fix and start exploiting a long time before most users are patched), or users who do not apply fixes.



Recently, Apple had to rush two emergency fixes for the kernel in Mac and iOS and for Webkit (Safari) for zero day vulnerabilities, and it’s hardly even like it’s rare for in-the-wild attack code to be targeting these platforms.



A while back, China attacked and targeted Uyghurs using a Safari vulnerability in the JavaScript engine. They’re not the only nation state that hoards software vulnerabilities. The US FBI and NSA are known to do it.



But aside from the sandbox escapes and arbitrary code execution are privacy problems that Tracking and Session-Replay scripts cause.



According to an article from VICE from 2017 (compacted with NewsWaffle and archived), at that time, 482 of the top 50,000 Web sites had JavaScript programs that followed the user around and recorded things that can even include keystrokes that aren’t “submitted” yet, and mouse movement patterns, and some even tie your activity to your real identity.



This is….super creepy and super sketchy!



Richard Stallman’s JavaScript Trap essay pointed out that many users end up running non-Free JavaScript programs without thinking much about it. I pointed out in an earlier post about how much I like the add-on NoScript.



In many cases, JavaScript is bloated, it’s spyware, it’s proprietary, and at the very least, it does something unwanted and aggravating, such as powering news site paywalls.



Firefox, some time ago, joined the majority of Web browsers in removing the user’s ability to turn off JavaScript globally, but NoScript can add this back. You can do whatever you want to. You can whitelist domains that are “Just Enough” to make the site work.



Even browsing in the non-default mode of “Temporarily Allow All Top-Level Domains” would provide a lot of protection from malicious, annoying, and bloated third-party scripts without forcing you to do too much manual intervention.



But it isn’t even like JavaScript engines really are that secure. By the time Mozilla finally does declassify security hole fixes for a Firefox release, you can go back and easily see that the majority of really nasty ones involved JavaScript, so the more domains you have it coming in and executing from, the more likely one is to come in and do _something_ nasty.



Odds approach 100% very quickly that your browser is running some kind of malware without telling you.



It’s bad enough when programs are “legitimate” in the sense that they are what they say they are, do something useful, and just won’t tell you how they do it. That’s what Stallman’s complaints were in The JavaScript Trap.



Unfortunately, there’s never been a more useful language to abuse the user with, or a better place to run it, than JavaScript in a Web browser.



Admitting defeat and turning it all on out of laziness simply ensures that you will be encountering serious malware at some point.



Unfortunately, the JavaScipt Problem is bigger yet than proprietary software and malware running behind-the-scenes. Some site owners set their Web sites to simply lock out people who are using Tor Browser, a VPN, or just simply have JavaScript turned off.



CloudFlare, a Web cancer that just keeps growing bigger, now hosts about 1/5th of major Web sites and about as many smaller ones too, and has convinced site owners to set “security” settings high to bounce people who fit these categories. I’m a VPN and Tor user with NoScript, so I run into problems with those “Checking your browser” pages somewhat frequently.



The other day, I was trying to look at an article on Bleeping Computer, and CloudFlare blocked me for using my VPN. So I opened up Opera, which I only occasionally use because CloudFlare blocks their Opera “VPN” (proxy) except in the EU for some reason, so I had to view the article in Opera and then close Opera.



JavaScript is a major annoyance on banking Web sites. One of the advantages of running NoScript and just whitelisting the top domain for the bank is that I use 6 banks, and they all work with just first party scripting turned on. The rest is Session-Replay, data analytics, and other crap and garbage.



Why do I want some creepy third-party script looking over my shoulder while I’m banking or using any Web site for that matter?



When I went to the United States Social Security Administration and the Internal Revenue Service, I even found Session-Replay scripts that they were attempting to load from third-party domains!



Once again, with these scripts excised from the site, the functionality I wanted to use still worked. With your Web browser’s default settings, spyware companies are recording your actions even on government Web sites that you have to use!



I counted at least six tracking companies monitoring your usage of the Social Security Administration’s site. They’ve even outsourced compliance with the Americans With Disabilities Act to a tracking company that records your session!



On top of the security and privacy concerns are more practical ones.



Some JavaScript malware is designed to commit theft of utilities. Some sites resort to “mining” cryptocurrency with JavaScript and WebAssembly (which NoScript also handles). This runs your CPU hard and causes your power bills to rise as your battery life falls.



Firefox, indeed most major Web browsers, now have some sort of anti-cryptomining feature, but nothing’s perfect. The less sites even have the permission the less chance they’ll get one of these loaded.



Tracking scripts also take resources to run. They slow down page loads and instruct your computer to do things. That’s not “free”.



The Web site owners don’t want to make a big fuss about all of this crap that they load, because when you investigate what the companies are telling them, it’s usually like, “We can help you monetize your site and optimize your search engine results and tell you all of these things about your visitors and what they do.”. Stealing your resources to benefit themselves is what they do.



How does this compare with ad blocking, or running add-ons such as Decentraleyes?



Ad blocking and Decentraleyes (which hosts commonly used Web frameworks locally to avoid Content Delivery Network requests) compliment NoScript and add to the privacy you can expect to gain from it.



uBlock-Origin (an ad and tracking blocker) is already a pretty big hammer. It will block ads and tracker lookups completely if they’re in your blacklists.



Unfortunately, many things are not included for whatever reason. They tend to give priority to not breaking anything on a site you could conceivably want to use, and there have been cases where tracking companies used the US DMCA to be removed from ad blocking lists. So it’s not bulletproof. There are too many things that slip past them, and that’s where NoScript comes in.



Between these things, you should be able to reduce your browsing data usage by about half.



There are a few other extensions I really like, such as Google Container. I don’t use Google very much (preferring the Free and Open Source Searx instances) and I’d like to stay logged in, but not outside that container (so Google can’t easily track me in general across the Web).



As I’ve increasingly focused on Gemini (such as Chilly Weather and the NewsWaffle on Gemi.dev) instead of the Web, I’ve found few cases where I actually need JavaScript to run to power something I want or need to do on the Web.



Ironically, writing this blog post about JavaScript requires me to run some JavaScript.



Even then, not all of the domains that the WordPress.com editor wants to load are necessary, and when I go to read blogs, I don’t need JavaScript at all. You don’t even need a graphical Web browser to read this. You can load it in text browsers that don’t even support JavaScript, with cookies turned off.



You should block most of WordPress’s JavaScript. I think most of it comes from analytics sites.



As I continue looking into an escape from the Web for most activities, I still occasionally need to watch a video or refill a prescription or make appointments with my doctor, or use some dumb banking site, and pay my taxes. Unfortunately, thanks to JavaScript being as widely abused as it now is, you need NoScript to make sure that these creepy programs can’t run.



I’m considering moving to a Gemlog instead of WordPress, but I’m going to have to learn how to do that so it may be a while. Eventually, I would like to leave an “I’m not here anymore. Use Gemini.” message on WordPress.



We’ll see when I manage to get around to this.



Until then, turn off your JavaScript, mostly. The Web is more pleasant when there’s less of it.



Although I mostly read news in the NewsWaffle, most of the annoyances and slowdowns (bloated JavaScripts, annoying videos, tracking) are gone from news sites with NoScript. Even when I load a CNN article with uBlock-Origin and NoScript, it comes up instantly. CNN is infamous for its terrible page load performance.



You can get NoScript here:



Firefox Add-Ons / Homepage



License: GNU General Public License Version 2



There is also a port of the extension available for Firefox on Android.



Unfortunately, iOS users will just have to live with JavaScript. The version of Firefox on iOS isn’t the real Firefox with Gecko. It’s a neutered version that has to use the same engine as Safari by diktat of Apple.



Unfortunately, this means Web browsers on iOS are insecure and impossible to fix, and issues such as the one Apple rushed an emergency fix for cannot be user-mitigated by blocking active content.



Recent Techrights' Posts

What's Very Vexing to GAFAM, EPO and Others Is That It's Incredibly Hard to Censor Us (and Nobody Ever Successfully Did That Before)
resist, do not capitulate
Receiving SLAPPs and Collecting Them Like Trophies (the SLAPPs Always Fail)
People who file lawsuits bring even more attention to themselves (or to embarrassing statements about them)
Year of GNU/Linux on the Laptop?
It's not happening only in Lenovo
What People Must Understand About the Open Source Initiative (OSI)
some facts about the Open Source Initiative (OSI)
More Copyright Lawsuits Against LLM Slop Providers and Suppliers of LLM Slopfarms Would Benefit Society
It's not just bad for the Web and for society; it's also legally dangerous
In defence of JD Vance, death of Pope Francis
Reprinted with permission from Daniel Pocock
Three Years in Prison for Disney Employee’s ‘Menu Hacking’: The Economic Fallout of Digital Menus
Reprinted with permission from Ryan Farmer
 
Microsoft Isn't on the Map in USSR
To them, it's either Google or Yandex
In Central America Windows Became a Small Force
These are countries where Windows used to have well over 95% of the "market"
Site May be Even Faster Now
It basically takes less than a tenth of a second to serve the page
Many of the Scandals Are Interconnected (Overlapping People and Corporations)
We're only getting started
Links 26/04/2025: General Assassinated in the Town of Balashikha, US Promoting Seafloor Mining
Links for the day
Links 26/04/2025: Facebook Layoffs Again, Remembering What's Real, and Say No to Mass Surveillance
Links for the day
Links 26/04/2025: NOAA Budget Cuts and "Dog Days Ahead"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, April 25, 2025
IRC logs for Friday, April 25, 2025
Links 25/04/2025: Slop Fatigue and Patent Judges Flocking to Fake, Unconstitutional and Illegal Kangaroo Court (UPC, Captured 'Justice')
Links for the day
Gemini Links 25/04/2025: Night Manager and Devuan in Hosting
Links for the day
Approaching 10,000 Articles/Pages Since Going Static
Trying to silence or derail the site was always a dumb strategy
Windows Falls to New Lows in Nicaragua, Now Below a Quarter (It Used to be Almost 100%)
Another all-time low for Windows
Microsoft is Shedding Off Loads of Staff and That Can be Dangerous Too
Working for Microsoft is a choice; nobody forces you to do it
Richard Stallman and the Unix Philosophy
When asked about systemd people must remember that RMS speaks as an active Board member of the FSF and also the founder of the FSF
The Cost (to Linux) of LLM Slop
Slop 'artists' like Fagioli are far from harmless
Links 25/04/2025: Ubisoft Spyware, Hegseth Fails at Tech on Every Level
Links for the day
Gemini Links 25/04/2025: Food Forest Update and Facebook Destroying the Net
Links for the day
Get Rid of Back Doors, Don't Obsess Over Bounties and Other Corporate PR Stunts (or Needless Reboot Rituals)
Security as a term has mostly lost its meaning due to repeated misuse for many years
Serial Sloppers Are Killing the Web (They Probably Don't Care, Either)
Slop is a disease on the Web
Streaming Apps Are “Investor Fraud” That Kills the Planet
Reprinted with permission from Ryan Farmer
Things Get Increasingly Nasty at Microsoft Ahead of the Fake Results and May's Mass Layoffs Wave
They try to get people to 'resign' so that they won't count as layoffs and the company's 'wellbeing' will seem better
IBM's Debt Ballooned by 8.5 Billion Dollars in Just 3 Months!
Hallmark of a company in a state of disarray, trying to spend its way out of trouble
Big Trouble in GNOME
even GNOME people admit the CoC went wrong
Slopping the Trough: Disney Plus Loses Billions and the Decline of Physical Media in America
Reprinted with permission from Ryan Farmer
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, April 24, 2025
IRC logs for Thursday, April 24, 2025
Links 24/04/2025: GAFAM Problems and No Peace (or Ceasefire) in Sight
Links for the day
Slopfarms on the Web Almost Always Generate Anti-Linux FUD When They Produce "Linux" Output
Welcome to the dying Web
Richard Stallman's Oxford Talk Has Just Ended, Here Are Some Photos
he might hop over to another European country
Gemini Links 24/04/2025: Birthday and Good Work of Academia in Esotericism
Links for the day
Links 24/04/2025: EU fines Apple and Facebook, Another Microsoft GitHub Security Blunder
Links for the day
New Article Explains How the GPL Came About and WordPress Having Copyleft Obligations
Having been involved in the WordPress development community since almost the beginning, I know why it chose the GPL and how it restricts abuse by Automattic
IBM Gained Almost 6 Billion Dollars in "Goodwill" Value in Just 3 Months, According to IBM
Congrats to the management!
In Belarus, Yandex is Now Measured as 50 Times More 'Popular' (by Usage) Than Microsoft
Yandex continues to gain, whereas Bing cannot even register at 1%. Last month it was registered or measured at a measly 0.65%.
IBM Cannot Lie to Shareholders Anymore
"I would not be surprised if we see a layoff every quarter this year."
Dr Richard Stallman (RMS) Gives Talk in Oxford University in 4 Hours
If you live nearby, go there (it's free as in gratis)
Using a Law Firm's Licence to Exercise Politics Through Frivolous SLAPPs and Nastygrams (to Silence People, Remove Pages, Demand Fake or Forced 'Apologies')
Things must be getting really bad when lawyers act for raving antisemites
We're Working to Make Full-Site Search Available
This site has over 1,000 'wiki' pages, many thousands of documents, several thousands of videos, and about 50,000 blog posts or articles. We need to make them easier to find/navigate.
Links 24/04/2025: IBM Loses Many Contracts, Intel to Lay Off Over 20% (Not Counting Those Who Leave 'Voluntarily')
Links for the day
Richard Stallman Can Explain to Oxford Artificial Intelligence Society Why LLM Slop is Not Artificial Intelligence and Why It Hurts Society
another 'crop' of LLM slop that damages GNU/Linux and facts
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, April 23, 2025
IRC logs for Wednesday, April 23, 2025