a good basic password system for a site is Gate Keeper. a a piece of
freeware javascript. but its easy to write your own... off hand im not
sure the exact coding. my JS knowledge is limited. but here it goes in
pidgeon english. 

inputs: password, username

URL = http://www.mydomain.com/123~12-45h/ + 'password' + /345fr2/ +
'username' .htm

so... if you input the wrong password and user name then you get a 404.
if its the right username and password then it completes the URL
correctly. no password or anything stored on the pge. so viewign the
source wont work. also, put in the meta tag that deletes the page from
the cache. and always put an index.htm (or equivilant) into each
directory, even if directory browsing is disabled.

best to be put into frames.

its the best system for JavaScript security. even putting the password
and username in a .JS file is flawed as you can get access to it. the
above method leaves no password and username in a file that can be
accessed. because it isnt there. and the url isnt easy to guess. because
that is what it comes down to. guessing. unless the *hacker (instert
desired word for person who breaks into site/server etc...) gets access
and sees the file structure.

its not 100% secure. but nothing is. its a good, cheap, easy to setup
password protection system.


-----Original Message-----
From: KathyW [mailto:kathyw(at)home.albury.net.au]
Sent: 13 July 2000 00:32
To: hwg-techniques(at)hwg.org
Subject: Re: Hackers


** Reply to message from Dennis Lapcewich
<Dennis.Lapcewich(at)unisa.edu.au> on
Wed, 12 Jul 2000 09:13:16 +0930


> Actually the term differences may be considered irrelevant when you
speak
> with the legal beagles.  It is my understanding in Australia the
> unauthorized access of a computer and/or data is a crime.  The intent
of
> that unauthorized access is irrelevant.

Perhaps, but the legal system and power brokers in this country (Oz) are
challenged by the technology behind a basic function hand-held
calculator. In a
court case you could probably get an extra months worth of legal fees
and
delays at least disputing the accepted media definition vs the industry
definition of "hacker" ... (Note to Lauri: for the rest of this post I
use the
media definition of "hacker" - Laurie read "hacker" as "cracker" where
appropriate ;-)

The problem here is that the government is driven more by media
perceptions
than public understanding, and have been known to change laws
retrospectively,
fast-track legislation to by-pass scrutiny and attempt to manipulate the
media
to support their position.

And somehow I don't think this is the only country thus afflicted ...

Recently we had a case of a young chap entering details on a government
site.
He entered an incorrect number sequence and in the process of submitting
a
(hand) modified URL to correct it he found the site was so insecure he
could
access details about other registrants without any difficulty and
emailed them
to warn them. Then our pm (prime minister. Note: lower case denotes lack
of
respect, not xhtml compliance) called him a "hacker".

How many of you have had to wade into a site's source html/javascript to
get
past sloppy site programming? I run primarilly under Linux and run into
windies
specific browser-sniffing, or ie specific code frequently. These sloppy
sites
have no fall-back alternatives, and once you get past their sloppy
sniffing or
re-directs, the pages work relatively well (I say "relatively" as the
rest of
the sites code is frequently as sloppy as the browser detection ...).

Where do you draw the line between "authorised" and "unauthorised"
access?
Shouldn't there be a duty of care by the site designers to make sure
that
things that shouldn't be accessed are protected by more that a token
gesture?
Shouldn't I and others like me be able to "hack" a sloppy site's source
to find
where a non-functional sniffer or re-direct would have sent me without
running
the risk of being declared a (media/pm definition) "hacker"?

Think about it folks. The media, legal profession and governments sure
as heck
can't tell the difference (generally).

KathyW.

Red Hat Linux 6.1 (kernel 2.2.14)
Sun JDK1.2.2
PolarBarMailer16b (beta/alpha ... what the heck, I like it ;-)

• Web Designer Courses
• Off the Shelf Training Courses

HWG hwg-techniques mailing list archives, maintained by Webmasters @ IWA