2

I ran across this on namecheap.com. This question isn't about namecheap.com itself, which I have no problem trusting. Rather, what approach do you recommend in dealing with CDN scripts that have very long random names? Now, I know they're most likely just how the main site decided to refer to external utility scripts they've put on a CDN.

But, if the main site had been hacked, the attackers could also inject a script to fire and use a long random name that looks innocuous by looking a like a utility script.

Is there any particular reason to be more cautious about these long random named scripts than for the more recognizably-named ones? I suppose not, but they do make me a bit queasy on NoScript. Especially on sites that I will enter credit cards into.

enter image description here

Improve this question

2 Answers 2

Reset to default
1

The Cloudfront URL is a unique identifier for namecheap' CDN.

There is nothing to worry about these urls. Regarding your question why to use such URL: my guess is that they don't use Cloudfront for their entire website (maybe not AWS at all). So they only use Cloudfront for their assets.

Although I don't see it your screenshot if the Cloudfront URL is used by the website itself or by a third party library.

Improve this answer
1
  • You say that there is nothing to worry about those URLs, but how do you know if they load malicious code or not? You can't, unless you read the code. So the correct answer should be: there is no way to know if randomString.cloudfront.net is operated by a malicious actor or if it is the official CDN used by a website, unless you dig into the code and check what it does.
    – reed
    Commented Mar 4, 2020 at 22:25
1

In my opinion, it's a problem that NoScript cannot solve.

NoScript allows you to browse the internet while trying to enable as little JavaScript as possible. In most cases you will be able to read text without enabling anything. But in some cases you will need to trust the main website and enable virtually everything to be able to use their services. In some cases you might even want to turn off NoScript, temporarily, to avoid bugs and make sure everything goes the way it's supposed to go. For example, even if you have enabled everything on a page, the next page might load different scripts that will be blocked, and you might end up submitting partial data, or submitting data twice, etc.

So on some websites and in some cases, NoScript might not be as useful as you think.

Improve this answer
2
  • oh, I understand all that, but my question was specifically about heuristics for dealing with what are essentially anonymous naming patterns on well-known CDNs. I actually never turn off NoScript, if things are bad enough I will use Vivaldi, which I use as a secondary browser, but never for any sensitive purposes
    – Italian Philosopher
    Commented Feb 29, 2020 at 16:47
  • @ItalianPhilosophers4Monica, and my answer tells you that NoScript isn't meant to protect you that way. In other words, there is no way to know if a random CDN on CloudFront is malicious or not, unless dig into the code and try to understand what it does.
    – reed
    Commented Mar 4, 2020 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .