NoScript Review: Clickjacking and XSS Protection for Firefox

You cannot use NoScript in any browser except Firefox, SeaMonkey, IceWeasel, MineField and Flock. There is no need to be advanced user in installing NoScript in supported browser. Once the browser has added NoScript add-on, you are ready to browse safely. Updating NoScript is done via browser's add-on manager or you can download it from Mozilla Add-on or NoScript websites.

Some websites that requires you to log-in (e.g. discussion or support forums), you might need to allow several domains that the site is using before you can open its login or use any site features. An example is CNET.com Forums, you will need to configure NoScript to allow the following: cnet.com, com.com. If not, the login link on top of the page will not load the login window.

The default option is recommended but for people who want to control how it works, below screenshots are the available options in using NoScript.

The new version of NoScript is effective in blocking active contents in a website. Previously, it is not very effective because I personally seen fake codec or malicious files being served while NoScript add-on is installed, after loading a malicious page while testing malware links, even without user interaction! Example is here and here. Thankfully, NoScript is updated frequently and become better. It’s not perfect but you can always report any issues (e.g. bypass, compatibility, false positive) at their forums.

Some people find NoScript is annoying because it blocks them in viewing the content. This should not stop you in using NoScript because you can always control what it will block and allow... as easy as 1...2...3!

NoScript is not going to hurt your pocket – it’s free! Support is offered via forums.