Viewing Thread:
"Password Encryption..."

Scenario - Internet cafe. Somebody has previously clicked 'Yes' and allowed Windows to remember a password. Somebody else comes along and uses the remembered password to access the protected area.

How can I stop this? Can I stop this?

My first thought is not calling the password input box "password" but will Windows just pickup that it is a password input box any way?

Help much appreciated on this one guys, Tyla, Turbonutter??

I have a screeny for you and it all looks cool, but luke's dead right now.

BTW, what server are you on? It's effing slow.

Thanks for your help guys, sorry I've been mega busy today, impending site launch and all. This is a tough one, no?

And, why didn't somebody tell me I won gameaday???? My first one! Cool.

Turbonutter wrote:
> 1) I have specifically killed my massive xemacs21 download JUST so I can have the bandwidth to talk to you - so stick around.

I'll be here till about 4.45, then ut again until 7.30am, so I'll try to catch you later or tomorrow.

> 2) I have "misplaced" the address (or even the thread) for that site you wanted me to check out under Linux

http://www.blackwell-synergy.com/

Could really do with some feed back on this specifically under Linux as at the mo we don't have access to a Linux test bed. my main concerns are GUI issues as this is my department, anything lese I'm not interested in!!

Cheers for this Rob

funkygamer wrote:
> Scenario - Internet cafe. Somebody has previously clicked 'Yes' and allowed Windows to remember a password. Somebody else comes along and uses the remembered password to access the protected area.

> How can I stop this? Can I stop this?

Right.. Here goes...

Unfortunately it's a problem with IE4+. IE and windows will not allow you to modify the security settings of the browser using javascript, but not sure about another langage, and the only way to prevent this will be to:

a) rely on the user not to hit yes
b) Rely on the organisation/company to have it's security settings set to prevent IE from rembering passwords, usernames, auto complete and form data (Any public access area should have these set to no as standard)

There is a way of getting around this, but the only site I have come accros that does is Hotmail with it's increased security option of shared computers?

We've been battling with this one for ages, and with the advent of IE6, things have got more difficult as it's a little security mad!!

Something was mentioned here about cookies and that MSIE stores all of this information ina text file on the system similar to a cookie and that one way around it would be to script it in a way as to prevent it from storing this info...

Tyla:

1) I have specifically killed my massive xemacs21 download JUST so I can have the bandwidth to talk to you - so stick around.

2) I have "misplaced" the address (or even the thread) for that site you wanted me to check out under Linux

Carry on... :)

Still in the process of trying to get the solution but you know what you dev types are like, never around when you need one!-)

It can be done, I'm just waiting for the explaination... Will report back as soon as I know!!

Unfortunately, IE (and all the others) are very clever with recognising user:pass boxes and renaming them rarely works. However, IE has an option you can not to store or request information. In the end however, it's the user's own stupid fault for clicking "yes".

Windows remebers it's inputs by the field name given to the input box, and verifying it with anyother information requested but I'm not sure about passwords.. In theory, you could rename the input box and set as hidden and use this as the password input instead?

How about Session ID's instead? It's all done with a cookie, so there must be a way pf preventing IE from caching a cookie from your side?

I'll ask about here as we do masses of password systems for various things..

Scenario - Internet cafe. Somebody has previously clicked 'Yes' and allowed Windows to remember a password. Somebody else comes along and uses the remembered password to access the protected area.

How can I stop this? Can I stop this?

My first thought is not calling the password input box "password" but will Windows just pickup that it is a password input box any way?

Help much appreciated on this one guys, Tyla, Turbonutter??