Having problems with message search?
Gary,
I looked at the actual script you got from DynamicDrive.com. That technique is not a secure way to protect your information.
The script essentially converts your password from an alpha string to a hex string, and compares the hex value to the one stored in your script. Any web visitor viewing the input screen that accepts your password can unravel this scheme.
Just View Source on your password page, and you'll see the script (it is javascript, after all). Once you see the code, it is easy to reverse-engineer it.
In fact, you can even figure out the name of the target page (your roster page, phone tree, or other page) by examining the script. It is VERY insecure.
A better solution would be to use a database of some kind to store the actual password. You should never store the actual password, encrypted or not, in the actual html page.
As webmaster of the Big Chicken Chorus, FREDquartet.com and a whole host of other websites, we use Microsoft ASP and server-sided scripting to provide this functionality. Even without a database, you can store the password as a server-side variable and validate it. The web viewer never sees the source code or the password - it's only stored internally on the server.
Then set a session variable to "keep it" in memory. That way, all of the pages you want to protect can check the session variable to see if the user has signed in. If not, every one of those protected pages is routed to the login screen.
If you'd like more information about these techniques, please let us know.
Steve Stern
Star-Tech Consulting
webmaster@... (and others)
From: Gary Efron [mailto:garyefron@...]
Sent: Wednesday, May 12, 2004 1:08 PM
To: BbshopWebGuild@yahoogroups.com
Subject: [BbshopWebGuild] Publishing Chorus Roster on Password Protected Web Site
Sent: Wednesday, May 12, 2004 1:08 PM
To: BbshopWebGuild@yahoogroups.com
Subject: [BbshopWebGuild] Publishing Chorus Roster on Password Protected Web Site
I am webmaster at the Paradise Valley Chapter at
www.cactuschordsmen.com. We have a password protected page that links
to our calling tree (both in Adobe Acrobat and MS WORD files), and our
weekly bulletin. I am using Dynamic Drive DHTML Scripts- Encrypted
Password script gotten at
http://www.dynamicdrive.com/dynamicindex9/password.htm. A member
suggested that I also put the chapter roster, which any SPEBSQSA
member can get for any chapter, on that password protected page.
My fear is that some robot will examine every page that it can harvest
for text that looks like email addresses, and use it for SPAM. I ran a
program called Webreaper that recreates a site that can be looked at
off-line. It was not able to find (or re-create) the password
protected page nor any of the files that page links to. Do you think
it is dangerous, in poor taste, or ethically incorrect to publish the
roster on the password protected page?
Chord-ially,
Gary Efron
webmaster@...
SINGgaryefron@...
Send Email
