As Internet finally starts to mature, people begin to realize how important online security
and privacy really are.
One of the most effective tools for security on the web is NoScript extension for Firefox.
NoScript was built to block execution of Javascript by your web browser in order to prevent infiltration
by malware, trackers and annoying ads.
Javascript, unfortunately, is still most frequent code used by web developers to deliver content
and run websites.
So if you want to experience the web fully, you’ll need to know how to operate NoScript
to get the most out of it.
The trade-offs are absolutely worth it.
For little inconvenience, you get a tremendous amount of security.
NoScript will act as a local firewall for your web browser, blocking malicious attacks
before they get a chance to get inside your system.
The best way to learn is on the go, so let’s get started.
You can install NoScript the same way you would install any add-on for Firefox.
When you first run it, this is what you are going to see.
For purposes of this tutorial, we’re going to test it on Reddit to see what it does.
When you load the website, a couple of things will happen by default.
First, NoScript is going to notify you about the number of blocked items.
When you open the menu, you’ll see that all three domains are set to DEFAULT trust
level.
By default, NoScript doesn’t trust these domains very much and blocks all javascript.
So let’s see how this effected the website.
You see that NoScript prevented a lot of content from loading.
And it also blocked an apparent advertisement.
But we want to use reddit so let’s see what we can do.
Open the menu by clicking on the NoScript icon again, and you’ll notice there’s
a faded blue S with a little clock icon.
So let’s click that.
When you close the menu, NoScript will automatically reload the page with scripts enabled for the
trusted domain.
As you can tell, we still can’t see much media so let’s temporarily trust some other
domains.
Click temporarily Trusted for redditmedia.com and redditstatic.com.
Now things start look very different.
You can see that upon allowing these domains to execute javascript, a bunch of other stuff
wants to make its way through your browser.
But NoScript blocks them by default, until you specifically allow them through the previous
process.
And this is how NoScript protects you.
It lets you be in control of what content websites execute and thus protects your online
privacy and security as well.
However, we only temporarily trusted Reddit, so that means if you close and restart your
browser, NoScript will not remember your preferences.
This has a quick fix.
Open the menu and click on the TRUSTED icon to make your trust level permanent.
Now each time you go to Reddit, it will load with all media content.
And while we are here, we can actually see that some javascripts want to track us and
load some advertisements.
By default, NoScript will only block javascript, but other content might have sneaked in.
To make sure NoScript blocks every request from these domains, we are going to set our
trust levels to UNTRUSTED.
And I can already tell you that you definitely don’t need googletagservices, googletagmanager,
and amazon-adsystem to enjoy Reddit.
These are trackers and advertisers that just want to sell your browsing history and preferences
to the highest bidder.
NoScript offers some options under the hood.
You can access them by clicking the third icon on the top left bar of the menu.
This will show you how NoScript functions in default settings.
Leave the option “Disable restrictions globally (dangerous)” unchecked, because this basically
turns NoScript off.
If you want to allow scripts for top-level domains, you can tell NoScript to trust them
by default by checking the box for “Temporarily set top-level sites to TRUSTED”.
But if privacy is your main concern I would recommend against that.
Below this, you can see what type of content NoScript is capable of blocking.
Since you installed NoScript to boost your privacy, I would recommend to uncheck all
the options in the default section.
This will give you maximum security as your default trust level will block everything.
In the per-site permission tab, NoScript saves all of your Trust levels for your record.
The green lock icon, as you can notice, means that it will Trust only encrypted HTTPS content
and anything that’s not secured will be blocked.
That’s very useful at preventing malicious scripts from executing on websites you visit.
You see that NoScript comes preloaded with some whitelist.
I personally don’t like this and I always set all of these websites to untrusted unless
I decide otherwise.
This whitelist was put in place to make NoScript more usable and convenient for less tech savvy users.
You can tweak your appearance a little bit if you want and you can leave the advanced
options as they are.
Back to the menu options, there are a couple of things you can do to play around.
NoScript gives you an option to choose what type of content to allow to make the website
functional instead of just allowing or blocking everything from each domain.
This option is in the fourth trust level called CUSTOM.
Custom trust level sets specific content to trusted and NoScript will remember your choices.
It will even give you some hints on what to allow to make a website functional.
If you just want to test what you can allow and block on a domain, you can set CUSTOM
level to temporarily trusted by clicking the little clock icon at the bottom right bar
of the CUSTOM column.
Because many scripts are loading in a cascading order, that is allowing script A, will load
script B and so on, which could not have been visible before, you might need to repeatedly
go back to the CUSTOM level and allow some more stuff to get proper functionality.
The best thing is that you only need to go through this process once and NoScript will
remember it.
In return you get back much of your online privacy and security in just a few clicks.
In this mode, NoScript will block auto-play media and will give you a click-to-play option.
If you don’t want to do that, you can always just find a content to allow in the CUSTOM
level or just set the whole domain to TRUSTED or temporarily TRUSTED.
If you don’t have time to pinpoint specific content to make a website functional, NoScript
lets you temporarily allow all scripts to load on the page with a single click on the
clock icon with a red exclamation point in the top right corner of the menu bar.
To revert all temporarily trusted choices, just click the last clock icon on the very
right to revoke all temporary permissions.
If you are really in a hurry, you can disable restrictions for the tab you are currently
on, which will allow all scripts from all cascading domains to load in one click.
To revert it, just click the tab icon with a red exclamation point again to enable NoScript
restrictions.
At the point of making this video, NoScript is not capable of blocking scripts as third
party while allowing them as first party at the same time.
For example, you might want to block Facebook social media pluggins that track your browsing
history.
This is when Facebook runs as a third party domain on websites.
But when you visit Facebook directly, you want it to run flawlessly.
That’s when Facebook runs as a first party domain.
To do that, you need extensions like uMatrix or uBlock Origin.
Luckily I have tutorials for both of them on my channel so feel free to check them out.
If you found this tutorial helpful, you might want to share it on your platforms of choice
or show it to your friends.
The more people protect their privacy, the more your privacy is protected as well.
So spread this message and subscribe to my channel to find out more about how you can
stand up for your digital rights.
Thanks for watching.