  Modern websites heavily rely on JavaScript (JS) to implement legitimate
functionality as well as privacy-invasive advertising and tracking. Browser
extensions such as NoScript block any script not loaded by a trusted list of
endpoints, thus hoping to block privacy-invasive scripts while avoiding
breaking legitimate website functionality. In this paper, we investigate
whether blocking JS on the web is feasible without breaking legitimate
functionality. To this end, we conduct a large-scale measurement study of JS
blocking on 100K websites. We evaluate the effectiveness of different JS
blocking strategies in tracking prevention and functionality breakage. Our
evaluation relies on quantitative analysis of network requests and resource
loads as well as manual qualitative analysis of visual breakage. First, we show
that while blocking all scripts is quite effective at reducing tracking, it
significantly degrades functionality on approximately two-thirds of the tested
websites. Second, we show that selective blocking of a subset of scripts based
on a curated list achieves a better tradeoff. However, there remain
approximately 15% `mixed` scripts, which essentially merge tracking and
legitimate functionality and thus cannot be blocked without causing website
breakage. Finally, we show that fine-grained blocking of a subset of JS
methods, instead of scripts, reduces major breakage by 3.8$\times$ while
providing the same level of tracking prevention. Our work highlights the
promise and open challenges in fine-grained JS blocking for tracking prevention
without breaking the web.
