jj2 wrote:
> hi all
> is it posible to make a page available to members only,ie
> password protected


If I've understood things correctly Freeola are currently working on a JavaScript plugin.

This would then allow you to control password protected areas - not as robust as .htaccess/.htpasswd but could work for you.





^{Hmmm...     My Freeola Instant Site}

Eccles wrote:
> I'm not sure how Javascript could provide password protected
> areas. It a client side scripting language that can easily be
> turned off by the user, bypassing any restrictions it controls.
> Page protection/user control is coming but there is no time
> scale yet.

As I said it isn't as robust as .htaccess; but there are a few Javascript's that will stop most surfers!

But if you are implementing improvements helping the OP then that also sounds promising!


EDIT: Or I could have just said you have to switch to a normally hosted site then you have lots of options! :¬P


^{Hmmm...     My Freeola Instant Site}

As I said it isn't very robust but is an option when .htaccess isn't available.

Unless you are storing MI5 secrets then you can project a 'members' page by using JavaScript!

Still don't believe me!

A quick Google found a decent looking script.
I've cobbled together a demo for you to crack:

JavaScript Password Challenge!

As you will see I've only added one user: 'Freeola'.
I've put a word on the projected page - just tell me what it is!

FAO staffies:
I know you've got access but NO cheating by FTPing to my webspace and looking for files! :¬P





^{Hmmm...     My Freeola Instant Site}

Freeola, remember no 'reverse engineering' by looking at my files!!!

Perhaps I should have put the demo with another host!

As long as you can explain how you cracked things I'll be happy...





^{Hmmm...     My Freeola Instant Site}

Just so you know Hmmm, nothing on the FTP will be different from viewing source in my Internet browser since your security solution you have chosen is in JavaScript which is completely client side coded and therefore available within a client browser.

Since your functions are all client side (presuming this is only a JS password login) then they will be reverse engineer-able.

Hmmm... wrote:
> I can 'see' a Freeola staffie has already looked at the members
> page!!! :¬P

That would be me, as I have nowhere near enough knowledge to crack this, I was 'reverse-engineering' a solution. LukeM knows nothing of what I discovered however :)

ButchML wrote:
> That would be me...

lol - you guys! I specifically said NO CHEATING! :¬)


I think I've sort of proved my point that you can use JavaScript to 'protect' a members page. No it isn't robust but a half decent script seems to be able to keep most surfers out!

Warhunt seems to think I'm wasting my time (I am!) but thought the effort was worth it to reply to Eccles & LukeM's earlier posts.

I can see some of Freeola's biggest brains (not just staffies) have had a go ;¬)


So IMO if this page is safe guarding the local WI's recipes it would do...



^{Hmmm...     My Freeola Instant Site}

Don't be so touchy! :¬)

Ha ha if anyone has time to do this rather than work, I think they need to be scalped :D -
that was what I meant about me 'wasting my time' - and I'm in agreement with you!


EDIT: I think I've read you all wrong!
were you referring to people trying the challenge? I thought you meant it was me that should be 'scalped'! :¬P


This all goes back to my InstantPro Javascript/Adsense post - I just mentioned (picking on Eccles not you!) that this was another thing to look forward to when the InstantPro JavaScript plugin is available.




^{Hmmm...     My Freeola Instant Site}

I was not making any noises Warhunt!! :S lol

Well I'm meant to be working anyways, stop trying to distract me Hmmm! The hashing function in JavaScript is mighty, I think the only way to reverse it, would not to reverse it and brute force it instead.

I'll try it when I get home from work :D I love the challenge Hmmm, a colleague suggested a "challenge Hmmm" forum!

Oh I need a scalping :'(

LukeM wrote:
> Ergghhhh, JavaScript is not secure.
> First rule of client side coding: Do not trust the client side.

Hmmm... see tag line! :¬)


Seems some JavaScripts are better than others...
<sup>It will 'brute force' it appears.


Hmmm...     My Freeola Instant Site</sup>

Garin wrote:
> Clever script.  More secure than many server side login scripts
> I've seen. :)  I imagine that hash function produces many
> collisions so not something you can reverse engineer.  Still as
> has been said, brute force and a few hours on a modern PC and
> you'd soon have all the answers.
>
> I see no problem in using such scripts as long as people are
> aware of the limitations and realise that its possible for the
> url to be passed around etc..  I imagine theres an AJAX version
> around somewhere to help hide the url from being plainly visible
> on the browser too.

Introducing AJAX with a back end script would be a more secure solution since it could do the secure part on the server side, however this wouldn't be possible with InstantPro, even if you could include JavaScript, since the AJAX call would need to be to another server which is a cross domain call that by default are blocked by modern browsers for security purposes :(

Two failed attempts and a pop up box saying Incorrect password! then I cracked it popped in my next attempt and page refreshed and no pop up box so does that mean I win?

Do I get a GAD ?

Digi

Any news on that humble pie? Is it taking a long time to bake??

jj2 wrote:
> many thanks all, hav'nt a clue what you are talking about but
> thanks anyway,looks like i will have to get my 10year old
> granddaughter to sort it out for me


Sorry your post went a little off-topic :¬)

The answer you were looking for was posted a while back:

Eccles(Freeola):
Page protection/user control is coming but there is no time scale yet.




^Hmmm...

I haven't even bothered looking into this weekend, you can see me eat humble pie in the fact I could not reverse engineer it, but not in the fact it cannot be cracked, I could simply make a PHP script to loop from AAAAAAAA to ZZZZZZZZ using your hashing algorithm (converted to PHP version of) and have a result pretty soon. There will be many ways of getting to the number 56095 which is the number hash of your password.

I just cannot be bothered to code the loop through from AAAAAAAA to ZZZZZZZZ, so I never touched it.

Looks like somebody's humble pie tasted very bitter. :P