1

I want to run a separate administrator account on my computer with Javascript disabled, to increase security.

Often disabling javascript is suggested as something that will block a recent 0day vulnerability. HTML supports reading pages of text already; this is not a javascript-only feature.

However support.microsoft.com refuses to show the content of text articles when javascript is disabled.

I can use Google's cache ("cached" link in search results), but this is very tedious. Is there really no way to view Microsoft's support articles, without enabling Javascript for any web page opened?

4
  • How did you manage to post this question if you have JavaScript disabled? ;)
    – DavidPostill
    Dec 18, 2016 at 14:15
  • :). "separate administrator account"
    – sourcejedi
    Dec 18, 2016 at 16:19
  • 1
    I suspect the answer to your question is no. I use noscript and only enable it where absolutely necessary.
    – DavidPostill
    Dec 18, 2016 at 16:21
  • I've checked the DOM of a no-scripted page and the content doesn't seem there. Are you willing to tweak the post URL by hand in order to retrieve the content? Dec 18, 2016 at 16:30

1 Answer 1

1

Just throwing stylish or a content blocker against the page will not suffice, because the data isn't there; you can verify that by searching the page source for a word that should be included in the page. The page script fetches parts of the page from many different sources (yes, it does hurt performance), and the article content specifically is fetched from https://support.microsoft.com/api/content/Asset/<id>.


Disclaimer: I'm not a security expert or anywhere close. Also, different users need different levels of security. Just because I don't say something is dangerous doesn't mean it's safe enough for you. I can't replace a paid advisor. Don't forget other lines of defense such as a VM if your situation warrants those.

I can think of the following options:

  • Enable JavaScript for this specific domain. While this isn't as secure as a full block, a domain whitelist is still safer than enabling JavaScript everywhere, as any attack vector would have to come through the whitelisted domain. Don't forget to only whitelist HTTPS URLs.

  • Replace the page JavaScript with your own addon, userscript or bookmarklet. Userscripts can still run even if page javascript is disabled by an addon, although your mileage may vary. A userscript that grabs the Angular framework from a local(ly cached) source and runs it against the page content might suffice, but I cannot give a definite promise regarding that.

    Beware of security, though. Installing the userscript from a local source prevents automatic upgrades, so use that. The worse part is that if you don't write the script yourself or inspect the source code, you'll have to trust the script author, and userscripts have somewhat higher privileges than page JavaScript and browser addons are even more powerful still, and you don't even trust the page's own JavaScript.

  • Use an external service to view the page - but any alternative to Google cache will likely be even less comfortable to use, unless you manage to find a mirror of Microsoft Help specifically.

  • Access the API endpoint directly. Tedious but secure. I'm not recommending this option, but it still exists.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .