[tor-bugs] #30600 [Applications/Tor Browser]: Restore NoScript control widget icon to the Tor Browser toolbar

[Tor Bug Tracker & Wiki]

#30600: Restore NoScript control widget icon to the Tor Browser toolbar
--------------------------------------+--------------------------
 Reporter:  cypherpunks               |          Owner:  tbb-team
     Type:  defect                    |         Status:  reopened
 Priority:  Very High                 |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Major                     |     Resolution:
 Keywords:  noscript                  |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by cyberpunks):

 Hi, different cyberpunks here than parent in this thread. I posted a
 similar issue the other day but I think it may be more useful to just
 comment here?

 I'd like to point out it's unclear whether adding custom icons reduces
 anonymity. (Either through the usual weird fingerprinting exploits - can
 someone programmatically detect url bar length? That's an open question.

 Forcing us to add the icon back (and some people may put said icon in
 different places) is risky. Especially since people who are advanced
 enough to use safest probably have increased risks if fingerprinted or
 deanonymized.


 Ex: if someone shares a screenshot it's something that makes them unique.
 (Ex: user collects something via Tor, shares with reporter, reporter
 shares screenshot, oppressive government notices both the leaked
 screenshots and the user's TBB setup have the icon placed to the left of
 the onion, whereas the other suspects either have no icon or have it in a
 different spot)

 Also, if you right click then click "noscript" that menu only comes up if
 the button is in the toolbar.

 Anyone who visits a social website may not want to use the "safer"
 security slider.

 For example I maintain an anonymous social media account on a site with
 many external links  - I do *not* trust every random thing linked to on
 the social media site, and strongly prefer to leave my browser on "safest"
 but allow only that site's JS, not everything it links to. I suspect there
 are many similar use cases where 1 site is trusted, but not the sites that
 may be linked to.

 If the developers are deadset on removing the icon, I think at least we
 should be able to access that functionality via the right click menu as a
 compromise,.

 I think it's reasonable to ask that either the control be present for
 safest users, or that the right click context menu work for advanced users
 if clutter is the concern.

 (Test for yourself on this page. Right click, then click "noscript". If
 there is no button in your toolbar, nothing appears)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30600#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online