Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #160495 > unrolled thread

Iceweasel + NoScript: Google search results href anomaly

Back to article view | Back to linux.debian.user

Contents

  Iceweasel + NoScript: Google search results href anomaly Safwat <softwatt@gmx.com> - 2015-11-12 22:10 +0100
    Re: Iceweasel + NoScript: Google search results href anomaly <tomas@tuxteam.de> - 2015-11-13 13:10 +0100
    Re: Iceweasel + NoScript: Google search results href anomaly Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2015-11-13 16:10 +0100
      Re: Iceweasel + NoScript: Google search results href anomaly Safwat <softwatt@gmx.com> - 2015-11-13 18:00 +0100
      Re: Iceweasel + NoScript: Google search results href anomaly Joel Rees <joel.rees@gmail.com> - 2015-11-14 05:10 +0100
    Re: Iceweasel + NoScript: Google search results href anomaly Safwat <softwatt@gmx.com> - 2015-11-14 10:10 +0100
      Re: Iceweasel + NoScript: Google search results href anomaly <tomas@tuxteam.de> - 2015-11-14 12:20 +0100
        Re: Iceweasel + NoScript: Google search results href anomaly Safwat <softwatt@gmx.com> - 2015-11-14 17:50 +0100
      Re: Iceweasel + NoScript: Google search results href anomaly Joel Rees <joel.rees@gmail.com> - 2015-11-15 01:00 +0100

#160495 — Iceweasel + NoScript: Google search results href anomaly

I am running NoScript + Iceweasel, and I observed something weird.
Consider a Google search result which has this "a href" value:

https://www.google.com/url?q=https://en.wikipedia.org/wiki/Hello_(Adele_song)&sa=U&ved=0CCsQFjAIahUKEwjPuq3H34vJAhWDWhQKHW7eCbA&usg=AFQjCNHJRKExeuRwwdFmAKkJ6dH7qv_TeQ

When I hover my mouse over it, the value instantly changes to
https://en.wikipedia.org/wiki/Hello_%28Adele_song%29

This should be impossible with NoScript, nothing should be able to
modify the DOM. Google is not white-listed.

What's going on?

[toc] | [next] | [standalone]

#160513

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Nov 12, 2015 at 10:46:23PM +0200, Safwat wrote:
> I am running NoScript + Iceweasel, and I observed something weird.
> Consider a Google search result which has this "a href" value:
> 
> https://www.google.com/url?q=https://en.wikipedia.org/wiki/Hello_(Adele_song)&sa=U&ved=0CCsQFjAIahUKEwjPuq3H34vJAhWDWhQKHW7eCbA&usg=AFQjCNHJRKExeuRwwdFmAKkJ6dH7qv_TeQ
> 
> When I hover my mouse over it, the value instantly changes to
> https://en.wikipedia.org/wiki/Hello_%28Adele_song%29

I'm not going to test that, since

 (a) I excised Javascript out of my default browser profile and only
    use a JS enabled profile in rare exceptions (yeah, some would
    say I 'crippled' my browser. To each her own)
 (b) I avoid Google as much as possible

but: are you sure that the "value" changes? Perhaps it's just the
visualization what changes, due to some CSS trickery? The way I
understand what you describe, this should be achievable without
Javascript (non-builtin, that is).

> This should be impossible with NoScript, nothing should be able to
> modify the DOM. Google is not white-listed.
> 
> What's going on?

I'd have a look at the CSS. Perhaps that's it. And then, perhaps
NoScript isn't as watertight as it should be (there are enough
reasons to not dismiss *that* possibility, alas)

regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZFynoACgkQBcgs9XrR2kbPWQCeNWO1NI8LgdeCRIofHlvsuDoi
pisAn0BMxBgrUVgzHoRs9Xwsyem0eYLI
=a9gL
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#160523

On Qui, 12 Nov 2015, Safwat wrote:
> I am running NoScript + Iceweasel, and I observed something weird.
> Consider a Google search result which has this "a href" value:
>
> https://www.google.com/url?q=https://en.wikipedia.org/wiki/Hello_(Adele_song)&sa=U&ved=0CCsQFjAIahUKEwjPuq3H34vJAhWDWhQKHW7eCbA&usg=AFQjCNHJRKExeuRwwdFmAKkJ6dH7qv_TeQ
>
> When I hover my mouse over it, the value instantly changes to
> https://en.wikipedia.org/wiki/Hello_%28Adele_song%29
>
> This should be impossible with NoScript, nothing should be able to
> modify the DOM. Google is not white-listed.
>
> What's going on?

Could it be NoScript itself, or another extension, changing the link  
to avoid Google tracking?

-- 
Eduardo M KALINOWSKI
eduardo@kalinowski.com.br

[toc] | [prev] | [next] | [standalone]

#160526

>Could it be NoScript itself, or another extension, changing the link to
avoid Google tracking?

That's definitely possible. I'll check it out.

[toc] | [prev] | [next] | [standalone]

#160550

On Sat, Nov 14, 2015 at 12:00 AM, Eduardo M KALINOWSKI
<eduardo@kalinowski.com.br> wrote:
> On Qui, 12 Nov 2015, Safwat wrote:
>>
>> I am running NoScript + Iceweasel, and I observed something weird.
>> Consider a Google search result which has this "a href" value:
>>
>>
>> https://www.google.com/url?q=https://en.wikipedia.org/wiki/Hello_(Adele_song)&sa=U&ved=0CCsQFjAIahUKEwjPuq3H34vJAhWDWhQKHW7eCbA&usg=AFQjCNHJRKExeuRwwdFmAKkJ6dH7qv_TeQ
>>
>> When I hover my mouse over it, the value instantly changes to
>> https://en.wikipedia.org/wiki/Hello_%28Adele_song%29
>>
>> This should be impossible with NoScript, nothing should be able to
>> modify the DOM. Google is not white-listed.
>>
>> What's going on?
>
>
> Could it be NoScript itself, or another extension, changing the link to
> avoid Google tracking?
>

No. It's Google's search re-direction. Been happening for a long time.
My memory is also that it is being done by css rather than by
javascript.

-- 
Joel Rees

Be careful when you look at conspiracy.
Arm yourself with knowledge of yourself, as well:
http://reiisi.blogspot.jp/2011/10/conspiracy-theories.html

[toc] | [prev] | [next] | [standalone]

#160558

For those who say it's a css thing:

1. The DOM is definitely changing. I can see that through inspect element.

2. It doesn't happen when NoScript is off and Firefox's
javascript_enabled is set to false.

[toc] | [prev] | [next] | [standalone]

#160562

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, Nov 14, 2015 at 10:47:13AM +0200, Safwat wrote:
> For those who say it's a css thing:
> 
> 1. The DOM is definitely changing. I can see that through inspect element.
> 
> 2. It doesn't happen when NoScript is off and Firefox's
> javascript_enabled is set to false.

Convinced.

Wow. That means that they bypass NoScript. Through technical or human
weakness, whatever.

That confirms me in my mistrust of such add-ons and on disabling Javascript
at a more fundamental level.

Seeing the path Mozilla is taking as of last, even that might not be
enough. An alternative browser seems in order (Pale Moon, Netsurf?).

Thanks for following up on this.

Regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZHDtsACgkQBcgs9XrR2kaZ/QCdFap/t182L9GRYhezg4n27TRB
XA0An1FpKv1PeF5OWqBSPyK2pwIpFyvd
=8cFl
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#160566

[Multipart message — attachments visible in raw view] — view raw

> Wow. That means that they bypass NoScript. Through technical or human
> weakness, whatever.

You're reaching conclusions too fast. It's possible that this is simply
NoScript disabling Google's tracking by modifying the URLS.

[toc] | [prev] | [next] | [standalone]

#160571

On Sat, Nov 14, 2015 at 5:47 PM, Safwat <softwatt@gmx.com> wrote:
> For those who say it's a css thing:
>
> 1. The DOM is definitely changing. I can see that through inspect element.

Can you tell if what you're looking at is before or after the stream
processing? I'm not familiar enough with firefox deugging to guess
what you are looking at.

> 2. It doesn't happen when NoScript is off and Firefox's
> javascript_enabled is set to false.

That does look more indicative, but I'm not positive.

I'm under the impression that most browsers re-use some of the
ecmascript machinery to do the css processing, and may end up shutting
down some of the parts of css that require more processing when you
completely disable scripting.

-- 
Joel Rees

Be careful when you look at conspiracy.
Arm yourself with knowledge of yourself, as well:
http://reiisi.blogspot.jp/2011/10/conspiracy-theories.html

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web