Is flash or javascript a bigger security concern?

Question

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this functionality, I have to enable javascript for the site resulting in a different kind of possible security vulnerability. This forces you to choose one or the other. Which would you be more concerned about in this situation?

Answer 1

The answer is: yes. You should always worry about software.

"Complexity is the worst enemy of secuirty"

--Bruce Schnieir

That being said, if your machine is fully patched one of the many flash 0-days will still compromise the machine. XSS is exploitable regardless if your machine patched. This flaw is usually exploited with JavaScript but it can be exploited with flash as well, so having either of them would be a problem. Its also important to note that about 90% of websites won't work with JavaScript, so disabling it is very problematic. GET based CSRF vulnerabilities can be exploited with pure html, so even if Flash and JS are disabled you can still be hacked.

What I would do: Use Firefox with NoScript. Even if javascript is globally enabled NoScript will block most CSRF and XSS attacks. Install an Anti-virus and keep the machine up to date.

Answer 2

i think, to block both are not better solution than, keep your system, flash engine, and antivirus updated. Flash and Javascript are not more dangerous than any other application in your computer. They had bugs? Yes, they were fixed? Yes. As your browser, as your operational system and as every single piece of software. With flash blocked. you should know that, for example, youtube won't work as expected. If you block javascript, some other sites that depends on, won't work, and maybe your wife's experience with internet won't be as she expects.

Answer 3

Actually neither one of these is the "bigger" security concern. DOM XSS is the largest concern as there is no real practical prevention against it. Also, trying to protect yourself by setting up a large white list of sites is going to cause more headaches than not. The recommendation is have one box for fun and one box for personal matters such as banking. Or to expound further setup a virtualized environment and have one system that does all the dangerous things involving flash or javascript and the other is where you can do you banking that has no flash or javascript enabled.

Answer 4

The question here is who creates more secure software? The people creating the browser or Adobe?

They are pretty much equal, especially with all the HTML 5 stuff. Usually you need to enable JavaScript for Flash, so you could so you add Flash as a potential bringing additional attack vectors.