08.29.22

Gemini version available ♊︎

Your Bank and Other Web Sites Are Running Creepy JavaScript That Records Your Every Action

Posted in Free/Libre Software, Protocol, Security, Standard at 2:51 pm by Guest Editorial Team

Reprinted with permission from Ryan

Your bank and other Web sites are running creepy “Session-Replay” JavaScript that follows you around the site recording your every movement.

You’re not “supposed to know” about this, but NoScript can block that from running.

I had a conversation with Matthew Garrett (alleged security person, actual drama bomb thrower) on IRC the other day about the “security” of JavaScript.

He had previously promoted it as a “great way of running untrusted code”.

Unfortunately, there’s just nothing secure about JavaScript. It’s the most widely abused platform in all of computing because almost everyone ends up running it without thinking of the consequences, and browsers which are instructed to do so, do it without bothering to allow any user control over the process in their default state.

If you can’t trust code, it’s better to not have it running at all.

Especially if it’s not doing anything to help you, and is proprietary.

Garrett said that “total sandbox escapes” where the program gets out of your browser sandbox and starts interfering with another tab or running arbitrary malicious code outside of any sort of confinement is “rare” to the point where someone would need to be “targeting you” and willing to blow a Zero Day exploit to do it.

That’s not exactly true as we see time and time again in the real world. But let us not hang ourselves up too long on what the Dalek of Social Justice has said.

If you drop a copy of O’Reilly’s book on Sixth Edition JavaScript from the kitchen counter, you’ll be walking with a limp for a while. Far from something that adds a little bit of “interactivity” to a Web page, JavaScript is a full blown computer programming language, Turing-complete, that can be used to write and run almost anything.

(I laughed the other day when I noted that someone had ported all of the LAME MP3 Encoder to JavaScript. It’s like, you could. But why? This is even dumber than online Office suites. People have spent years and lots of effort writing high performance encoding routines in C. Let’s make things worse and shove it to a Web server!)

Very little of what I do on the Web calls for something like JavaScript.

Nobody asked me if I wanted applications that run best on my computer, where I control them, where Big Brother is not looking over my shoulder replaced by some online version on someone else’s computer that I may or may not be able to access, and if I can, it’s watching what I do with it.

I don’t use Services as a Software Substitute where I can avoid it, and the ones I do use tend to be licensed under the GNU Affero General Public License, which makes them Free and Open Source Software.

If I don’t like someone’s Searx search engine, I can use someone else’s. If I don’t like a Matrix (protocol) chat server’s moderation, I can go use another one. If anyone wants to know what the source code does, or make their instance work differently, they can!

Web applications don’t have to be malicious. It’s just that many of them are.

In general, every way that Microsoft’s proprietary software could hurt you before is wrong with their Web applications, and then they’ve invented new ways of being nasty as well. So thanks, no thanks.

The people who invented the Web and the earliest browsers (such as Marc Andreeson, who said as much in 1994) wanted to keep it lightweight. The idea of JavaScript and even Cascading Style Sheets were controversial.

They knew that if these “features” were added, the consequences would be severe. And they are severe!

The Web has basically become Microsoft Windows. Bloated, fat, slow, and requiring a new computer every 4-5 years because of how painful things get. Features that are only useful to advertisers and marketers and spyware and other parasites being bolted on with no debate by Google and Microsoft, and tossed in by Mozilla and Apple “for compatibility”. Worse, it’s all impossible to secure and it’s rather embarrassing how complicated the standards are to get it to do much at this point. (There are starting to be chat servers implemented in GeminiSpace. But on the Web, you need to run a 600 MB tab for that!).

Worse, the Web rots. It’s become mostly a spam farm. Things disappear. Domain squatters come in. All your links go to a scam now. The entire thing has become so balkanized by megacorporations that come and go that if you use those “services”, every 10 years you have to figure out where all the people you used to talk to are.

We have to start backing away from standards that are hacked together by companies that won’t exist in a few years based on speculative business plans, many of which ought to be criminal.

Attackers take advantage of whatever they can.

They take advantage of poorly coded applications, gaps in security policy whether deliberate or accidental (some Windows malware includes the calculator from Windows 7 to get past User Account Control and evade virus scanners, for example), or software distributors like Apple which do not ship Web browser security updates quickly (giving the attackers time to study the fix and start exploiting a long time before most users are patched), or users who do not apply fixes.

Recently, Apple had to rush two emergency fixes for the kernel in Mac and iOS and for Webkit (Safari) for zero day vulnerabilities, and it’s hardly even like it’s rare for in-the-wild attack code to be targeting these platforms.

A while back, China attacked and targeted Uyghurs using a Safari vulnerability in the JavaScript engine. They’re not the only nation state that hoards software vulnerabilities. The US FBI and NSA are known to do it.

But aside from the sandbox escapes and arbitrary code execution are privacy problems that Tracking and Session-Replay scripts cause.

According to an article from VICE from 2017 (compacted with NewsWaffle and archived), at that time, 482 of the top 50,000 Web sites had JavaScript programs that followed the user around and recorded things that can even include keystrokes that aren’t “submitted” yet, and mouse movement patterns, and some even tie your activity to your real identity.

This is….super creepy and super sketchy!

Richard Stallman’s JavaScript Trap essay pointed out that many users end up running non-Free JavaScript programs without thinking much about it. I pointed out in an earlier post about how much I like the add-on NoScript.

In many cases, JavaScript is bloated, it’s spyware, it’s proprietary, and at the very least, it does something unwanted and aggravating, such as powering news site paywalls.

Firefox, some time ago, joined the majority of Web browsers in removing the user’s ability to turn off JavaScript globally, but NoScript can add this back. You can do whatever you want to. You can whitelist domains that are “Just Enough” to make the site work.

Even browsing in the non-default mode of “Temporarily Allow All Top-Level Domains” would provide a lot of protection from malicious, annoying, and bloated third-party scripts without forcing you to do too much manual intervention.

But it isn’t even like JavaScript engines really are that secure. By the time Mozilla finally does declassify security hole fixes for a Firefox release, you can go back and easily see that the majority of really nasty ones involved JavaScript, so the more domains you have it coming in and executing from, the more likely one is to come in and do _something_ nasty.

Odds approach 100% very quickly that your browser is running some kind of malware without telling you.

It’s bad enough when programs are “legitimate” in the sense that they are what they say they are, do something useful, and just won’t tell you how they do it. That’s what Stallman’s complaints were in The JavaScript Trap.

Unfortunately, there’s never been a more useful language to abuse the user with, or a better place to run it, than JavaScript in a Web browser.

Admitting defeat and turning it all on out of laziness simply ensures that you will be encountering serious malware at some point.

Unfortunately, the JavaScipt Problem is bigger yet than proprietary software and malware running behind-the-scenes. Some site owners set their Web sites to simply lock out people who are using Tor Browser, a VPN, or just simply have JavaScript turned off.

CloudFlare, a Web cancer that just keeps growing bigger, now hosts about 1/5th of major Web sites and about as many smaller ones too, and has convinced site owners to set “security” settings high to bounce people who fit these categories. I’m a VPN and Tor user with NoScript, so I run into problems with those “Checking your browser” pages somewhat frequently.

The other day, I was trying to look at an article on Bleeping Computer, and CloudFlare blocked me for using my VPN. So I opened up Opera, which I only occasionally use because CloudFlare blocks their Opera “VPN” (proxy) except in the EU for some reason, so I had to view the article in Opera and then close Opera.

JavaScript is a major annoyance on banking Web sites. One of the advantages of running NoScript and just whitelisting the top domain for the bank is that I use 6 banks, and they all work with just first party scripting turned on. The rest is Session-Replay, data analytics, and other crap and garbage.

Why do I want some creepy third-party script looking over my shoulder while I’m banking or using any Web site for that matter?

When I went to the United States Social Security Administration and the Internal Revenue Service, I even found Session-Replay scripts that they were attempting to load from third-party domains!

Once again, with these scripts excised from the site, the functionality I wanted to use still worked. With your Web browser’s default settings, spyware companies are recording your actions even on government Web sites that you have to use!

I counted at least six tracking companies monitoring your usage of the Social Security Administration’s site. They’ve even outsourced compliance with the Americans With Disabilities Act to a tracking company that records your session!

On top of the security and privacy concerns are more practical ones.

Some JavaScript malware is designed to commit theft of utilities. Some sites resort to “mining” cryptocurrency with JavaScript and WebAssembly (which NoScript also handles). This runs your CPU hard and causes your power bills to rise as your battery life falls.

Firefox, indeed most major Web browsers, now have some sort of anti-cryptomining feature, but nothing’s perfect. The less sites even have the permission the less chance they’ll get one of these loaded.

Tracking scripts also take resources to run. They slow down page loads and instruct your computer to do things. That’s not “free”.

The Web site owners don’t want to make a big fuss about all of this crap that they load, because when you investigate what the companies are telling them, it’s usually like, “We can help you monetize your site and optimize your search engine results and tell you all of these things about your visitors and what they do.”. Stealing your resources to benefit themselves is what they do.

How does this compare with ad blocking, or running add-ons such as Decentraleyes?

Ad blocking and Decentraleyes (which hosts commonly used Web frameworks locally to avoid Content Delivery Network requests) compliment NoScript and add to the privacy you can expect to gain from it.

uBlock-Origin (an ad and tracking blocker) is already a pretty big hammer. It will block ads and tracker lookups completely if they’re in your blacklists.

Unfortunately, many things are not included for whatever reason. They tend to give priority to not breaking anything on a site you could conceivably want to use, and there have been cases where tracking companies used the US DMCA to be removed from ad blocking lists. So it’s not bulletproof. There are too many things that slip past them, and that’s where NoScript comes in.

Between these things, you should be able to reduce your browsing data usage by about half.

There are a few other extensions I really like, such as Google Container. I don’t use Google very much (preferring the Free and Open Source Searx instances) and I’d like to stay logged in, but not outside that container (so Google can’t easily track me in general across the Web).

As I’ve increasingly focused on Gemini (such as Chilly Weather and the NewsWaffle on Gemi.dev) instead of the Web, I’ve found few cases where I actually need JavaScript to run to power something I want or need to do on the Web.

Ironically, writing this blog post about JavaScript requires me to run some JavaScript.

Even then, not all of the domains that the WordPress.com editor wants to load are necessary, and when I go to read blogs, I don’t need JavaScript at all. You don’t even need a graphical Web browser to read this. You can load it in text browsers that don’t even support JavaScript, with cookies turned off.

You should block most of WordPress’s JavaScript. I think most of it comes from analytics sites.

As I continue looking into an escape from the Web for most activities, I still occasionally need to watch a video or refill a prescription or make appointments with my doctor, or use some dumb banking site, and pay my taxes. Unfortunately, thanks to JavaScript being as widely abused as it now is, you need NoScript to make sure that these creepy programs can’t run.

I’m considering moving to a Gemlog instead of WordPress, but I’m going to have to learn how to do that so it may be a while. Eventually, I would like to leave an “I’m not here anymore. Use Gemini.” message on WordPress.

We’ll see when I manage to get around to this.

Until then, turn off your JavaScript, mostly. The Web is more pleasant when there’s less of it.

Although I mostly read news in the NewsWaffle, most of the annoyances and slowdowns (bloated JavaScripts, annoying videos, tracking) are gone from news sites with NoScript. Even when I load a CNN article with uBlock-Origin and NoScript, it comes up instantly. CNN is infamous for its terrible page load performance.

You can get NoScript here:

Firefox Add-Ons / Homepage

License: GNU General Public License Version 2

There is also a port of the extension available for Firefox on Android.

Unfortunately, iOS users will just have to live with JavaScript. The version of Firefox on iOS isn’t the real Firefox with Gecko. It’s a neutered version that has to use the same engine as Safari by diktat of Apple.

Unfortunately, this means Web browsers on iOS are insecure and impossible to fix, and issues such as the one Apple rushed an emergency fix for cannot be user-mitigated by blocking active content.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. Links 08/02/2023: Transmission 4.0.0 Released and Mass Layoffs at Zoom

    Links for the day



  2. IRC Proceedings: Tuesday, February 07, 2023

    IRC logs for Tuesday, February 07, 2023



  3. When the Pension Vanishes

    Today we commenced a multi-part mini-series about pensions and what happens when they suddenly vanish and nobody is willing to explain where all the money went



  4. Sirius 'Open Source' Pensiongate: An Introduction

    The Sirius ‘Open Source’ series continues in the form of a mini-series about pensions; it’s part of an ongoing investigation of a deep mystery that impacts people who left the company quite a long time ago and some of the lessons herein are applicable to any worker with a pension (at times of financial uncertainties)



  5. Links 07/02/2023: Endless OS 5.0 and Voice.AI GPL Violations

    Links for the day



  6. No Doubt Microsoft Unleashed Another 'Tay', Spreading Bigotry Under the Guise of Hey Hi (AI)

    Reprinted with permission from Ryan



  7. Links 07/02/2023: Fedora 39 Development Plans Outlines

    Links for the day



  8. IRC Proceedings: Monday, February 06, 2023

    IRC logs for Monday, February 06, 2023



  9. Links 06/02/2023: Escuelas Linux 8.0 and Many Political Issues

    Links for the day



  10. Links 06/02/2023: Sparky 6.6 and IPFire 2.27 – Core Update 173

    Links for the day



  11. Taking Back Control or Seizing Autonomy Over the News Cycle (Informing People, Culling the Marketing)





  12. Reality Versus Fiction: EPO Insiders Versus EPO Web Site and UPC 'Churnalists'

    The "official" sources of the European Patent Office (EPO), as well as the sedated "media" that the EPO is bribing for further bias, cannot tell the truth about this very large institution; for proper examination of Europe's largest patent office one must pursue the interpretation by longtime veterans and insiders, who are increasingly upset and abused (they're being pressured to grant patents in violation of the charter of the EPO)



  13. Links 06/02/2023: Linux 6.2 RC7 and Fatal Earthquake

    Links for the day



  14. IRC Proceedings: Sunday, February 05, 2023

    IRC logs for Sunday, February 05, 2023



  15. Links 05/02/2023: Wayland in Bookworm and xvidtune 1.0.4

    Links for the day



  16. Links 05/02/2023: Pakistan Blocks Wikipedia, Musharraf Dies

    Links for the day



  17. IRC Proceedings: Saturday, February 04, 2023

    IRC logs for Saturday, February 04, 2023



  18. Links 04/02/2023: FOSDEM Happening and Ken Thompson in SoCal Linux Expo

    Links for the day



  19. 2023 is the Year Taxpayers' Money Goes to War and Energy Subsidies, Not Tech

    Now that a lot of powerful and omnipresent ‘tech’ (spying and policing) companies are rotting away we have golden opportunities to bring about positive change and maybe even recruit technical people for good causes



  20. Getting Back to Productive Computer Systems Would Benefit Public Health and Not Just Boost Productivity

    “Smartphoneshame” (shaming an unhealthy culture of obsession with “apps”) would potentially bring about a better, more sociable society with fewer mental health crises and higher productivity levels



  21. Links 04/02/2023: This Week in KDE and Many More Tech Layoffs

    Links for the day



  22. Dotcom Boom and Bust, Round 2

    The age of technology giants/monopolies devouring everything or military-funded (i.e. taxpayers-subsidised) surveillance/censorship tentacles, in effect privatised eyes of the state, may be ending; the United States can barely sustain that anymore and raising the debt ceiling won't solve that (buying time isn't the solution)



  23. Society Would Benefit From a Smartphoneshame Movement

    In a society plagued by blackmail, surveillance and frivolous lawsuits it is important to reconsider the notion of “smart” phone ownership; these devices give potentially authoritarian companies and governments far too much power over people (in the EU they want to introduce new legislation that would, in effect, ban Free software if it enables true privacy)



  24. IRC Proceedings: Friday, February 03, 2023

    IRC logs for Friday, February 03, 2023



  25. IRC Proceedings: Thursday, February 02, 2023

    IRC logs for Thursday, February 02, 2023



  26. Links 03/02/2023: Proton 7.0-6 Released, ScummVM 2.7 Testing

    Links for the day



  27. Links 03/02/2023: OpenSSH 9.2 and OBS Studio 29.0.1

    Links for the day



  28. Links 03/02/2023: GNU C Library 2.37

    Links for the day



  29. Sirius Finished

    Yesterday I was sent a letter approving my resignation from Sirius ‘Open Source’, two months after I had already announced that I was resigning with immediate effect; they sent an identical letter to my wife (this time, unlike before, they remembered to also change the names!!)



  30. The Collapse of Sirius in a Nutshell: How to Identify the Symptoms and Decide When to Leave

    Sirius is finished, but it's important to share the lessons learned with other people; there might be other "pretenders" out there and they need to be abandoned


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts