Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am looking for a way of doing this because my PC is used by more people. Just in case they need to see my saved passwords, they can just type some JavaScript in the address bar and voila..they can see the values of some of my login forms..

I googled and googled but found nothing that can help me customize Firefox by disabling the javascript: pseudo-protocol.

Any ideas?

share|improve this question

migrated from stackoverflow.com Sep 15 '10 at 11:41

This question came from our site for professional and enthusiast programmers.

    
This isn't a programming question, voting to move to superuser. –  T.J. Crowder Sep 15 '10 at 10:31
    
I don't really understand your question. but what I do understand I don't think is possible or at least easy to do –  WalterJ89 Sep 15 '10 at 10:32
    
@T.J. Crowder He mentioned using javascript so it is a programming question. –  WalterJ89 Sep 15 '10 at 10:33
2  
If you think that's bad, try going to Tools->Options->Security->Saved Passwords ;) –  Rushyo Sep 15 '10 at 10:47
1  
Also a tip for future: catb.org/~esr/faqs/smart-questions.html#goal –  Rushyo Sep 15 '10 at 10:48

5 Answers 5

If your machine is used by more than just you and those other users have the same rights to the machine that you have, then you can't disable JavaScript (or anything else) in a way that will prevent them re-enabling it. All modern OSes (including Windows, at least Vista and up and probably earlier) have the ability to restrict (even encrypt) the data in your account's home directory, which is where Firefox stores your information. If you use named user accounts on your system (whether it's Windows, Linux, Mac OS, etc.), you should be able to protect your privacy in a much more robust way than by trying to disable JavaScript.

share|improve this answer
4  
Also, if you are worried about passwords on a shared account... don't save your passwords –  Kristoffer S Hansen Sep 15 '10 at 10:45

There is one way to accomplish this. The NoScript extension adds the preference to disable Javascript in the url bar. You can find it by visiting 'about:config' and searching for 'noscript.allowURLBarJS' once you install the extension.

However, this does not actually help you in your circumstances, as stated in the other posts. I'm posting this for Googler's benefit.

May propose patching Fx to add this feature in the stock release regardless, for other security reasons.

share|improve this answer

Your question makes sense and I'm sure is solvable somehow, but your basic premise doesn't sound right.

, they can just type some JavaScript in the address bar and voila..they can see the values of some of my login forms..

Why? There should be no otherwise hidden form values that are somehow accessible through the Javascript protocol. I think either the sites you use have a serious security problem, or you are misunderstanding something.

share|improve this answer

Thanks for all your thoughts.

I managed to disable Tools -> Options -> Security -> Saved Passwords so nobody can look there for my saved passwords.

In order to explain my problem better, here's an example:

  1. I have admin rights on my PC. The other users don't.
  2. I have a basic CMS.
  3. The login form fields such as the password one can be read by using the following piece of JavaScript code: javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j

Thus, if I saved the username and password for later use, somebody else can access my login form, choose the username (was saved), then the password will show up in its field and the user can jus type the JavaScript code from above and an alert window will popup with my password. You can try that..just go to https://login.yahoo.com/config/login_verify2?.intl=us&.src=ym and enter an username and type a test pass. Then use the code from above.

That's just an example.

So, what I would like to do is:

  1. disable window.alert in Firefox
  2. or, disable JavaScript input in the browser address bar.

Thanks for all your help guys.

share|improve this answer
    
Better to update your question than to post an "answer" that updates it. There's an "edit" link on questions... –  T.J. Crowder Sep 15 '10 at 14:35

As Rushyo said, it can be done (I just tested it) by using that extension and alter noscript.allowURLBarJS by making it false instead of true. Then, I can block the access to about:config. However, how can we do that in a much simpler way, without the need of installing an extension?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.