Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this functionality, I have to enable javascript for the site resulting in a different kind of possible security vulnerability. This forces you to choose one or the other. Which would you be more concerned about in this situation?

share|improve this question
6  
I think there is probably a very useful question underneath this, but as it stands this is quite subjective; some individuals may worry more about one or the other (or both) but that might not be useful for you at the end of the day. Can you reword the question more towards specifics? –  Rory Alsop May 7 '11 at 15:41
    
Edited to meet your request –  Dan May 8 '11 at 10:09
1  
Still looking a bit subjective to me. If you're really worried about scripts and plugins, I suggest using Firefox with NoScript. NoScript not only does not require JavaScript (AFAIK) - it blocks it, along with any other plugin-based content, for domains not already whitelisted by you. The whitelist is also pretty easy to manage on-the-fly. –  Iszi May 9 '11 at 5:07

4 Answers 4

The answer is: yes. You should always worry about software.

"Complexity is the worst enemy of secuirty"

--Bruce Schnieir

That being said, if your machine is fully patched one of the many flash 0-days will still compromise the machine. XSS is exploitable regardless if your machine patched. This flaw is usually exploited with JavaScript but it can be exploited with flash as well, so having either of them would be a problem. Its also important to note that about 90% of websites won't work with JavaScript, so disabling it is very problematic. GET based CSRF vulnerabilities can be exploited with pure html, so even if Flash and JS are disabled you can still be hacked.

What I would do: Use Firefox with NoScript. Even if javascript is globally enabled NoScript will block most CSRF and XSS attacks. Install an Anti-virus and keep the machine up to date.

share|improve this answer
1  
+1 for NoScript! –  Iszi May 9 '11 at 5:08

i think, to block both are not better solution than, keep your system, flash engine, and antivirus updated. Flash and Javascript are not more dangerous than any other application in your computer. They had bugs? Yes, they were fixed? Yes. As your browser, as your operational system and as every single piece of software. With flash blocked. you should know that, for example, youtube won't work as expected. If you block javascript, some other sites that depends on, won't work, and maybe your wife's experience with internet won't be as she expects.

share|improve this answer

Actually neither one of these is the "bigger" security concern. DOM XSS is the largest concern as there is no real practical prevention against it. Also, trying to protect yourself by setting up a large white list of sites is going to cause more headaches than not. The recommendation is have one box for fun and one box for personal matters such as banking. Or to expound further setup a virtualized environment and have one system that does all the dangerous things involving flash or javascript and the other is where you can do you banking that has no flash or javascript enabled.

share|improve this answer
    
+1 for the virtualised box: this way you can always start with a known clean box adn wipe it at the end of each session. –  Rory Alsop May 7 '11 at 15:37

The question here is who creates more secure software? The people creating the browser or Adobe?

They are pretty much equal, especially with all the HTML 5 stuff. Usually you need to enable JavaScript for Flash, so you could so you add Flash as a potential bringing additional attack vectors.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.