🚀 go-pugleaf

In message <d8492f7f4e.g4iat@demon.co.uk>, at 23:29:06 on Wed, 1 Nov 
2006, Barry Smith <baz@g4iat.demon.co.uk> wibbled
>Hi
>
>First time posting here. Wasn't aware of its existence until
>I started searching demon.net.

Welcome. A few regulars still around to answer the passing queries so 
don't be too put off by the quietness. Also have a look at the group 
uk.net.web.authoring which is far busier but is probably less likely
to generate a quick answer to 'can I do this on the homepages service'.
>
>I have a homepage/website but I'd like some extra pages which
>are only accessed by a username and password.
>
>Is it possible to do this simply with some HTML and an encrypted
>password file, or does it need some this PHP or MySQL stuff (of
>which I know nothing!)
>
Ideally you'd want PHP/MySQL, .htaccess/.htpassword or other server side 
solution where the user can't get to see the code etc. - as they work 
server side then they complete before any web page is served up to the 
visitor. However Demon homepages doesn't support these (see note:)


The only way to do it presently all on the Homepages service is with 
javascript. For example, <http://javascript.internet.com/passwords/>
has some scripts.

They mainly work by matching username and sending you to the page 
password.htm (where password is the actual password entered) if you 
input the right password or by sending you to a specific page if 
username and password matches.

'Gatekeeper' and 'Login Coder' are two from the above page that work on 
this principle that are straight forward to use. The first is far 
simpler than the latter so would be far quicker to reverse engineer.


There's a few points to be aware of:

a) The user needs javascript enabled on their web browser;
b) The javascript can be seen by viewing the source. If the user can
    read the javascript then it can be reverse engineered;
c) If the page that is linked to has links from other than the login
    page then it may turn up in Search Engines or the page directly
    linking to it turns up in Search Engines.

Therefore I wouldn't recommend it for more than casual security.


Note: we have been promised a Control Panel for Homepages that will 
include .htaccess (and perhaps a .htpassword facility)  but it hasn't 
arrived yet...


Hope this answers it. Any further queries or if don't understand 
something then don't hesitate to ask. We don't bite ;-)

-- 
Pedt
uk.announce ~ moderated group to announce news / events of specific interest to
a wider uk.* readership than the group(s) which their subjects would naturally
place them. See charter at <http://www.usenet.org.uk/uk.announce.html>

In message <d8492f7f4e.g4iat@demon.co.uk>, Barry Smith 
<baz@g4iat.demon.co.uk> wrote
>Hi
>
>First time posting here. Wasn't aware of its existence until
>I started searching demon.net.
>
>I have a homepage/website but I'd like some extra pages which
>are only accessed by a username and password.
>
>Is it possible to do this simply with some HTML and an encrypted
>password file, or does it need some this PHP or MySQL stuff (of
>which I know nothing!)
>
As I understand it, it is not possible to do this on a Demon homepages 
site, because it would require the running of code on the server when a 
user wanted access and that option is not provided on Demon homepages. 
[It is possible on a commercial-pages Demon site but these cost A Lot 
More.]

I've copied this to demon.service because many people read that who know 
more about these things than I do :)
-- 
Andy
For Austria & its philately, Lupus, & much else visit
<URL:http://www.kitzbuhel.demon.co.uk/>

In message <jRo$dwKvvbSFFwqw@user-unknown.mx2.org.uk>, Pedt <"\"@ 
@\""@user-unknown.mx2.org.uk> writes
>In message <d8492f7f4e.g4iat@demon.co.uk>, at 23:29:06 on Wed, 1 Nov 
>2006, Barry Smith <baz@g4iat.demon.co.uk> wibbled
>>Hi
>>
>>First time posting here. Wasn't aware of its existence until
>>I started searching demon.net.
>
>Welcome. A few regulars still around to answer the passing queries so 
>don't be too put off by the quietness. Also have a look at the group 
>uk.net.web.authoring which is far busier but is probably less likely
>to generate a quick answer to 'can I do this on the homepages service'.
>>
>>I have a homepage/website but I'd like some extra pages which
>>are only accessed by a username and password.

[Big snip of excellent advice]

Hi Barry - Pedt is absolutely right (I learned a great deal from him 
longer ago than either of us would like to admit).

If you like to email me I have a small page with script (JavaScript) 
that does more or less what Pedt describes.  In this case it uses a 
JavaScript Alert Box for password entry which makes it just that little 
bit more difficult to see the underlying source code in a browser. 
(Still not absolutely secure).  It allows a limited number of passwords 
all leading to the same "hidden" page.)

I didn't write it!
>
>Hope this answers it. Any further queries or if don't understand 
>something then don't hesitate to ask. We don't bite ;-)
>
Absolutely!  Not for many years . .  .   :-)
-- 
Duncan K
Downtown Dalgety Bay

In message <7dnH44Bt+cSFFw5F@apbz24.dial.pipex.com>, Duncan Kennedy 
<obg@nospamotterson-bg.couk> writes
>
>If you like to email me I have a small page with script (JavaScript) 
>that does more or less what Pedt describes.

Sorry about that, Barry - forgot the munged reply address.  Try removing 
nospam and putting the stop back between the co and the uk if you want 
to email.

-- 
Duncan K
Downtown Dalgety Bay

In message <6md3JgB0mcSFFw74@kitzbuhel.demon.co.uk>, Andy 
<andy@kitzbuhel.demon.co.uk> writes
>In message <d8492f7f4e.g4iat@demon.co.uk>, Barry Smith 
><baz@g4iat.demon.co.uk> wrote
>>Hi
>>
>>First time posting here. Wasn't aware of its existence until
>>I started searching demon.net.
>>
>>I have a homepage/website but I'd like some extra pages which
>>are only accessed by a username and password.
>>
>>Is it possible to do this simply with some HTML and an encrypted
>>password file, or does it need some this PHP or MySQL stuff (of
>>which I know nothing!)
>>
>As I understand it, it is not possible to do this on a Demon homepages 
>site, because it would require the running of code on the server when a 
>user wanted access and that option is not provided on Demon homepages. 
>[It is possible on a commercial-pages Demon site but these cost A Lot 
>More.]
>
>I've copied this to demon.service because many people read that who 
>know more about these things than I do :)

AIUI, it's not possible to use .htaccess to password-protect folders or 
files, etc. on the Homepages servers. It can be done to a low level, 
IIRC, with Javascript, though not securely enough to exclude someone who 
*really* wanted to get in, and knew how. However, I believe it *is* 
possible (because I know someone who did it, albeit a few years ago) to 
use a third-party password protection thingie. I'll see if I can find 
the details.

cheers,
robin

-- 
PISCES Conservation Ltd, IRC House, The Square
Pennington, Lymington, Hants, SO41 8GN, UK
Tel +44 (0)1590 676622  Fax +44 (0)1590 675599
www.irchouse.demon.co.uk        www.pisces-conservation.com
www.powerstationeffects.co.uk      www.amazonian-fish.co.uk
Trust me, I'm a webmaster...

In article <6md3JgB0mcSFFw74@kitzbuhel.demon.co.uk>,
Andy <andy@kitzbuhel.demon.co.uk> a wrote:

> As I understand it, it is not possible to do this on a Demon homepages 
> site, because it would require the running of code on the server when a 
> user wanted access and that option is not provided on Demon homepages. 

It wouldn't require any user provide code on the server.  I think the
real reason for this is to make homepages unattractive to business
users, so that they will pay a premium price for their web space.

Unfortunately this sort of policy tends to result in work arounds with
the result that many web designers learn their trade without being able
to set up important server options, and continue to use scripting, etc.,
hacks even when they are employed by someone with proper server access.

In message <d8492f7f4e.g4iat@demon.co.uk>
          Barry Smith <baz@g4iat.demon.co.uk> wrote:


> I have a homepage/website but I'd like some extra pages which
> are only accessed by a username and password.

Thanks to all of you for your fast, friendly advice.

I'm going to be (unexpectedly) offline for a couple of days, so will
follow up on the answers in more detail early next week.

The password idea is just to put off the 'casual' lurker. There's
nothing really sensitive on the pages, so the idea of someone
'unauthorised' finding a way in doesn't concern me too much.

The Javascript method sounds like it might fit the bill.

I'll be back...

Thanks

Barry
-- 
NOTE: No trees were killed in the sending of this message,
but a large number of electrons were terribly inconvenienced.

In article "Password protection on some pages?" in <demon.service>, on
Thu, 2 Nov 2006 Andy <andy@kitzbuhel.demon.co.uk> writes

>>I have a homepage/website but I'd like some extra pages which
>>are only accessed by a username and password.
>>
>>Is it possible to do this simply with some HTML and an encrypted
>>password file, or does it need some this PHP or MySQL stuff (of
>>which I know nothing!)

It is possible to do it with JavaScript, but it is very, very tedious
(see footnote). And it is not worth it! 

The alternative does not require PHP or mySQL, but you *do* need some
web space that is not as restricted as Demon's homepages. 

So my suggestion is: do not use Demon homepages. You can generally buy
web space quite cheaply, from the same place you buy your email
forwarding.

If the web space you purchase allows you to upload a .htaccess file,
then you can use that to control access to the pages. It is very simple,
although you will need to learn how to generate the associated encrypted
password files.

If your web space allows you to run PHP then there are several methods
of simulating the effect of a .htaccess file "manually" as it were., if
your provider wont let you use a .htaccess file. You'll need a book on
PHP.

Footnote
--------
Essentially, one way to do it with JavaScript would be to use the
document.write() function to construct a document only if there was a
specific query string appended to the page's URL.  Although this is not
at all secure because the JavaScript to write the document will be
visible to anyone inspecting your HTML.  Its hardly worth doing unless
you want to practice writing JavaScript - which is always worthwhile :-)

On the page that requires the password, you would set up a web Form (for
example) to construct the query string.  

Regarding a password file: you cannot actually use a *file* because JS
wont read files, so you must embed all your passwords in your HTML page,
or in a JS file that you call from the web page. And there's no point in
encrypting anything because your JS will all be visible to a hacker
anyway. You might want to construct the query string to include some
hash of the current date, so you can stop old URLs floating around that
give access to your secret pages. But as I said above, they are not
really 'secret' in any meaningful sense anyway.

Despite this lack of security with JavaScript, I came across a
supposedly secure page on the Liverpool University site, once, in which
highly confidential documents were protected by a little bit of
JavaScript. Not only did I guess the password first go (it was the name
of the project) but I discovered that you could gain access simply by
turning off JavaScript in your browser. Without it running to prevent
you from accessing the page you could ... err... access the page. And
the implication of this bad usage of JS was ... get this ... Google was
able to read and index all the pages too. 
-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In message <101db27f4e.g4iat@demon.co.uk>
          Barry Smith <baz@g4iat.demon.co.uk> wrote:


> The Javascript method sounds like it might fit the bill.
> 
> I'll be back...

I'm back. Having experimented with one of the codings[1] at
http://javascript.internet.com/passwords/ I suspect it
wont work for me. I ought to mention that I'm using RISC OS,
not Windows.

Using a browser called WebsterXL I get the panel to enter a
username and password but then get a javascript error.
Using Netsurf or Oregano2 it displays all the code!
Maybe I've made an error copying/pasting the coding. It
would be interesting to check this with a site that does
use this (or similar) javascript.

As the page I planned to protect will be predominantly for
RISC OS users this isn't going to work.

I suspect I will have to just leave it as it is now. The page
is not linked/indexed from any other page on the site.

It seems I have two other options - wait for .htaccess on the
homepages or set up a different site.

Thanks for your help and advice anyway.

Barry

[1] The first one - Advanced Password Checker.
-- 

In message <VMKjV1B5XhUFFw82@mcrosolv.demon.co.uk>, David Gibson 
<david@[127.0.0.1]> writes
>In article "Password protection on some pages?" in <demon.service>, on
>Thu, 2 Nov 2006 Andy <andy@kitzbuhel.demon.co.uk> writes
>
>>>I have a homepage/website but I'd like some extra pages which
>>>are only accessed by a username and password.
>>>
>>>Is it possible to do this simply with some HTML and an encrypted
>>>password file, or does it need some this PHP or MySQL stuff (of
>>>which I know nothing!)
>
>It is possible to do it with JavaScript, but it is very, very tedious
>(see footnote). And it is not worth it!
>

Not really - there are several downloads available and I've offered the 
OP a simple page with JavaScript to use.  I have no experience of 
writing JavaScript but this one is easily modified for the OP's purpose.

> Although this is not
>at all secure because the JavaScript to write the document will be
>visible to anyone inspecting your HTML.

The page with embedded JavaScript I have offered actually uses a 
JavaScript Alert Box for entering the password.  As this appears on *top 
of the HTML page with the JavaScript the usual method of "View Source" 
etc. is not available.

Sure, there are ways of getting the code and I wouldn't use it for 
highly confidential information, but, as I understand it,  the OP is not 
worried about hackers - just wants to make some family pages not 
immediately available to the outside world.

-- 
Duncan K
Downtown Dalgety Bay

In message <VMKjV1B5XhUFFw82@mcrosolv.demon.co.uk>
          David Gibson <david@[127.0.0.1]> wrote:

> In article "Password protection on some pages?" in <demon.service>, on
> Thu, 2 Nov 2006 Andy <andy@kitzbuhel.demon.co.uk> writes
> 
> >>I have a homepage/website but I'd like some extra pages which
> >>are only accessed by a username and password.

> It is possible to do it with JavaScript, but it is very, very tedious
> (see footnote). And it is not worth it! 
> 
> The alternative does not require PHP or mySQL, but you *do* need some
> web space that is not as restricted as Demon's homepages. 
> 
> So my suggestion is: do not use Demon homepages. You can generally buy
> web space quite cheaply, from the same place you buy your email
> forwarding.

Email forwarding? Don't know what that is (and probably don't
need to know?).

It looks as though I would need my own domain. Not only could I
apply password protection I could also have more than the homepage
20MB restriction (which is surely silly these days... unless you
happen to be Demon hoping the customer upgrades to a 'commercial' site).

[snip remainder of useful info]

Thanks for the comments

Barry
-- 

In message <fUleaQF+QkUFFwNn@apbz24.dial.pipex.com>
          Duncan Kennedy <obg@nospamotterson-bg.couk> wrote:


> Sure, there are ways of getting the code and I wouldn't use it for 
> highly confidential information, but, as I understand it,  the OP is not 
> worried about hackers - just wants to make some family pages not 
> immediately available to the outside world.

You understand correctly, but see my other post re. problems
with Javascript on RISC OS browsers.

Barry
-- 

In message <4cb4be824e.g4iat@demon.co.uk>, Barry Smith 
<baz@g4iat.demon.co.uk> wrote
[
>It looks as though I would need my own domain. Not only could I
>apply password protection

That's a function of who hosts your domain and what facilities they 
provide or tolerate, not of simply having your own. Indeed, 
"g4iat.d.c.u" *is* your own domain.

>I could also have more than the homepage
>20MB restriction (which is surely silly these days... unless you
>happen to be Demon hoping the customer upgrades to a 'commercial' site).
>
Agreed :(

Their last 'excuse' was that if they allowed some people to have more, 
then they'd have to provide sufficient physical space for everybody for 
some technical reason that I didn't fully understand. I would suspect 
commercial pressures. Mind you, other ISPs offer even less space (eg 
10Mb) on their smallest account.
-- 
Andy
For Austria & its philately, Lupus, & much else visit
<URL:http://www.kitzbuhel.demon.co.uk/>

In message <b9a9bb824e.g4iat@demon.co.uk>, Barry Smith 
<baz@g4iat.demon.co.uk> writes
>In message <101db27f4e.g4iat@demon.co.uk>
>          Barry Smith <baz@g4iat.demon.co.uk> wrote:
>
>
>> The Javascript method sounds like it might fit the bill.
>>
>> I'll be back...
>
>I'm back. Having experimented with one of the codings[1] at
>http://javascript.internet.com/passwords/ I suspect it
>wont work for me. I ought to mention that I'm using RISC OS,
>not Windows.

That's a pity.  I have no experience of RISC OS.
>
>Using a browser called WebsterXL I get the panel to enter a
>username and password but then get a javascript error.
>Using Netsurf or Oregano2 it displays all the code!
>Maybe I've made an error copying/pasting the coding. It
>would be interesting to check this with a site that does
>use this (or similar) javascript.
>
>As the page I planned to protect will be predominantly for
>RISC OS users this isn't going to work.

I would be interested in what happens with the system I have used under 
RISC browsers if you would care to experiment.  I haven't got a system 
to check it with.  I *have checked with various Linux browsers. 
Unfortunately there isn't anything on any of my sites using it at the 
moment.
>
>I suspect I will have to just leave it as it is now. The page
>is not linked/indexed from any other page on the site.

Just a quick word of warning - you probably know of this anyway - do 
remember to use both a simple robots.txt and, in all your "hidden" 
pages, a "noindex, nofollow" tag .  I remember a client of mine 
forgetting the latter and finding that his hidden pages were all 
carefully listed in Google!
>

-- 
Duncan K
Downtown Dalgety Bay

In article <fRoOLDBLUwUFFwN5@apbz24.dial.pipex.com>, dated Thu, 9 Nov 
2006,  Duncan Kennedy <obg@nospamotterson-bg.couk> wrote
>In message <b9a9bb824e.g4iat@demon.co.uk>, Barry Smith 
><baz@g4iat.demon.co.uk> writes

>>I suspect I will have to just leave it as it is now. The page
>>is not linked/indexed from any other page on the site.
>
>Just a quick word of warning - you probably know of this anyway - do 
>remember to use both a simple robots.txt and, in all your "hidden" 
>pages, a "noindex, nofollow" tag .  I remember a client of mine 
>forgetting the latter and finding that his hidden pages were all 
>carefully listed in Google!
>>
>
I have this arrangement too, for some pages I put up for my students - 
not particularly private but I don't really want them Googled - but I 
don't know about robots txt and noindex etc.  Please could you 
elaborate?


-- 
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne if you want
to reply personally

In message <$AzIpeFxh1UFFw40@cockaigne.demon.co.uk>, Kate Brown 
<elvira@cockaigne.demon.co.uk> writes
>In article <fRoOLDBLUwUFFwN5@apbz24.dial.pipex.com>, dated Thu, 9 Nov 
>2006,  Duncan Kennedy <obg@nospamotterson-bg.couk> wrote
>>In message <b9a9bb824e.g4iat@demon.co.uk>, Barry Smith 
>><baz@g4iat.demon.co.uk> writes
>
>>>I suspect I will have to just leave it as it is now. The page
>>>is not linked/indexed from any other page on the site.
>>
>>Just a quick word of warning - you probably know of this anyway - do 
>>remember to use both a simple robots.txt and, in all your "hidden" 
>>pages, a "noindex, nofollow" tag .  I remember a client of mine 
>>forgetting the latter and finding that his hidden pages were all 
>>carefully listed in Google!
>>>
>>
>I have this arrangement too, for some pages I put up for my students - 
>not particularly private but I don't really want them Googled - but I 
>don't know about robots txt and noindex etc.  Please could you elaborate?
>
First, a file called "robots.txt" (no quotes) in the root folder of your 
site.  Just plain text with a variation on the following to suit your 
whole site:

User-agent: *
Disallow: /list/
Disallow: /list/info.htm
Disallow: /list/proposal.htm
Disallow: /list/index.htm
Disallow: /guestbook/
Disallow: /guestbook/guestbook.html
Disallow: /guestbook/addguest.html

The hidden folders in this case were in a folder called "list".  The 
guestbook entries were because the client was using a host that offered 
a guestbook that was being hit by porn sites offering links!

Then each hidden file needs a meta tag:

<meta name="robots" content="NOINDEX, NOFOLLOW">

in the <HEAD> section of the HTML code - I put mine near the top along 
with other tags.

If you have your "hidden" files in a folder of their own you can 
complicate things even further by having the index.htm file a simple 
page saying something like "Sorry, this section is not in use yet and is 
being held for testing."  Then start your hidden section with a menu 
under a different name - like "menu.htm".  That way those stumbling on 
the folder name will, with luck, think there is nothing there.  Remember 
you *must have the index.htm or the reader will be presented with a 
whole list of the files in that sub-directory if they just add the 
folder name to the URL.

You can be doubly sure by adding another robots.txt to the root of your 
hidden folder - just change the file / dir3ectory names to suit.

Of course the purists will tell you this isn't safe but, for the 
purpose, it actually works unless you have people determined enough to 
a0 suspect you have something to hide and b) be willing to take a lot of 
trouble to find it.

Come back here or by email if you have any questions.
-- 
Duncan K
Downtown Dalgety Bay

In message <VMKjV1B5XhUFFw82@mcrosolv.demon.co.uk>, Wed, 8 Nov 2006 
17:38:01, David Gibson <david@[127.0.0.1]> writes

> You might want to construct the query string to include some hash of 
>the current date,

But remember that the current date is rarely the same world-wide.

Best to use the current UTC date, and to allow also the string for the 
adjacent date (clocks are not perfectly synchronised).

It's a good idea to read news:comp.lang.javascript and its FAQ. See below.

-- 
  (c) John Stockton, Surrey, UK.  ?@merlyn.demon.co.uk   Turnpike v6.05   IE 6
  <URL:http://www.jibbering.com/faq/>? JL/RC: FAQ of news:comp.lang.javascript
  <URL:http://www.merlyn.demon.co.uk/js-index.htm> jscr maths, dates, sources.
  <URL:http://www.merlyn.demon.co.uk/> TP/BP/Delphi/jscr/&c, FAQ items, links.

In article "Password protection on some pages?" in <demon.service>, on
Wed, 8 Nov 2006 Duncan Kennedy <obg@nospamotterson-bg.couk> writes

>The page with embedded JavaScript I have offered actually uses a 
>JavaScript Alert Box for entering the password.  As this appears on *top 
>of the HTML page with the JavaScript the usual method of "View Source" 
>etc. is not available.

It is if you turn off JavaScript in your browser.

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid

In article "Password protection on some pages?" in <demon.service>, on
Wed, 8 Nov 2006 Barry Smith <baz@g4iat.demon.co.uk> writes

>> So my suggestion is: do not use Demon homepages. You can generally buy
>> web space quite cheaply, from the same place you buy your email
>> forwarding.
>
>Email forwarding? Don't know what that is (and probably don't
>need to know?).

Probably not :-)

I was thinking that if you bought a domain such as barry.smith.name, or
baz.com or whatever, then you would arrange for mail to that domain to
be forwarded to your Demon account, where you would collect it.  But
quite often, people selling web space will also sell you a POP3 mailbox
too.  Or you might not want to have a mail address at that domain
anyway.

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In article "Password protection on some pages?" in <demon.service>, on
Fri, 10 Nov 2006 David Gibson <david@[127.0.0.1]> writes

>In article "Password protection on some pages?" in <demon.service>, on
>Wed, 8 Nov 2006 Duncan Kennedy <obg@nospamotterson-bg.couk> writes
>
>>The page with embedded JavaScript I have offered actually uses a 
>>JavaScript Alert Box for entering the password.  As this appears on *top 
>>of the HTML page with the JavaScript the usual method of "View Source" 
>>etc. is not available.
>
>It is if you turn off JavaScript in your browser.

... Sorry, I forgot to add... And since Google has no concept of
JavaScript, it will index the page regardless of the fact that you have
tried to protect it!  I.e. all the content is visible to Google.

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In message <vYitQ3BetFVFFwzF@mcrosolv.demon.co.uk>, David Gibson 
<david@[127.0.0.1]> writes
>
>... Sorry, I forgot to add... And since Google has no concept of
>JavaScript, it will index the page regardless of the fact that you have
>tried to protect it!  I.e. all the content is visible to Google.
>

What about using Robots.txt and a no index - no follow tag for the 
important pages?

-- 
Duncan K
Downtown Dalgety Bay

In message <oIUs0WBHiFVFFwTv@mcrosolv.demon.co.uk>, David Gibson 
<david@[127.0.0.1]> writes
>In article "Password protection on some pages?" in <demon.service>, on
>Wed, 8 Nov 2006 Duncan Kennedy <obg@nospamotterson-bg.couk> writes
>
>>The page with embedded JavaScript I have offered actually uses a
>>JavaScript Alert Box for entering the password.  As this appears on *top
>>of the HTML page with the JavaScript the usual method of "View Source"
>>etc. is not available.
>
>It is if you turn off JavaScript in your browser.
>
Even including a "hide from non-javascript browsers"?  That prevents my 
script from showing in the browsers I have tried (Opera, Firefox, IE, 
Konqueror - it also prevents the password page from showing but then 
there would be no point in turning JavaScript off if you had been told 
the password and that you needed it to use the facility.

And remember this would be in a non-linked sub-directory and *not in the 
index.htm page, which should be a cover.

Yes, there are other ways of seeing the code (and fairly simple ones 
too) - if the reader can find the page - but remember the whole purpose 
that the OP had in mind.  It may well be that my code would not work on 
RISC OS but I doubt if it would show.

-- 
Duncan K
Downtown Dalgety Bay

In article "Password protection on some pages?" in <demon.service>, on
Fri, 10 Nov 2006 Duncan Kennedy <obg@otterson-bg.co.uk> writes

>>all the content is visible to Google.
>
>What about using Robots.txt and a no index - no follow tag for the 
>important pages?

Yes, that should work.

>>> "View Source" etc. is not available.
>>
>>It is if you turn off JavaScript in your browser.
>>
>Even including a "hide from non-javascript browsers"?

Do you mean the comment lines that hide the contents of the <SCRIPT> tag
from browsers that do not understand it?  If so, then "yes", it makes no
difference.

>That prevents my script from showing in the browsers I have tried
>(Opera, Firefox, IE, Konqueror

Hmmm, perhaps you mean something else then?  I do not know of (nor
believe that there is) any method (that doesnt require server-side
scripting, anyway) of being able to stop JS code from appearing in a
"view source" window.  Your comment above, notwithstanding :-)

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In message <BXDWDHHavLVFFwXH@mcrosolv.demon.co.uk>, David Gibson 
<david@[127.0.0.1]> writes
>In article "Password protection on some pages?" in <demon.service>, on
>Fri, 10 Nov 2006 Duncan Kennedy <obg@otterson-bg.co.uk> writes
>
>>>all the content is visible to Google.
>>
>>What about using Robots.txt and a no index - no follow tag for the
>>important pages?
>
>Yes, that should work.
>
>>>> "View Source" etc. is not available.
>>>
>>>It is if you turn off JavaScript in your browser.
>>>
>>Even including a "hide from non-javascript browsers"?
>
>Do you mean the comment lines that hide the contents of the <SCRIPT> tag
>from browsers that do not understand it?  If so, then "yes", it makes no
>difference.
>
>>That prevents my script from showing in the browsers I have tried
>>(Opera, Firefox, IE, Konqueror
>
>Hmmm, perhaps you mean something else then?  I do not know of (nor
>believe that there is) any method (that doesnt require server-side
>scripting, anyway) of being able to stop JS code from appearing in a
>"view source" window.  Your comment above, notwithstanding :-)
>
I think we are probably talking at cross purposes here.  Yes the View 
Source will still show - although I seem to remember there is a way to 
prevent this, I can't remember how!  However with a password page 
"hidden" in a "hidden" directory (i.e.not indexed or linked) will appear 
blank if JavaScript is turned off and for the casual viewer that is 
likely to be enough.

Remember the context of this discussion - JavaScript methods are 
certainly not secure but they do help to keep the casual searcher away 
and in a casual scan of the script the password is not necessarily 
obvious (particularly if the word is carefully chosen to look *like a 
scripting instruction or word used in the script and the variable is 
*not called "password" ) - although it certainly can be found without 
too much effort.
-- 
Duncan K
Downtown Dalgety Bay

In message <h4Iu4hB0mFVFFwRC@mcrosolv.demon.co.uk>
          David Gibson <david@[127.0.0.1]> wrote:


> >Email forwarding? Don't know what that is (and probably don't
> >need to know?).
> 
> Probably not :-)
> 
> I was thinking that if you bought a domain such as barry.smith.name, or
> baz.com or whatever, then you would arrange for mail to that domain to
> be forwarded to your Demon account, where you would collect it.  But
> quite often, people selling web space will also sell you a POP3 mailbox
> too.  Or you might not want to have a mail address at that domain
> anyway.

Thanks for the explanation.

Barry
-- 

In message <KH8rOGBaA2UFFwuP@apbz24.dial.pipex.com>
          Duncan Kennedy <obg@nospamotterson-bg.couk> wrote:

> In message <$AzIpeFxh1UFFw40@cockaigne.demon.co.uk>, Kate Brown 
> <elvira@cockaigne.demon.co.uk> writes
> >In article <fRoOLDBLUwUFFwN5@apbz24.dial.pipex.com>, dated Thu, 9 Nov 
> >2006,  Duncan Kennedy <obg@nospamotterson-bg.couk> wrote
> >>In message <b9a9bb824e.g4iat@demon.co.uk>, Barry Smith 
> >><baz@g4iat.demon.co.uk> writes
> >
> >>>I suspect I will have to just leave it as it is now. The page
> >>>is not linked/indexed from any other page on the site.
> >>
> >>Just a quick word of warning - you probably know of this anyway - do 
> >>remember to use both a simple robots.txt and, in all your "hidden" 
> >>pages, a "noindex, nofollow" tag .  I remember a client of mine 
> >>forgetting the latter and finding that his hidden pages were all 
> >>carefully listed in Google!
> >>>
> >>
> >I have this arrangement too, for some pages I put up for my students - 
> >not particularly private but I don't really want them Googled - but I 
> >don't know about robots txt and noindex etc.  Please could you elaborate?
> >
> First, a file called "robots.txt" (no quotes) in the root folder of your 
> site.  Just plain text with a variation on the following to suit your 
> whole site:

snip detail.

Many thanks for explaining that. I had assumed (wrongly) that
the pages *not* linked from the main page would not be picked
up by a search engine.

The more I discover, the more I realise how little I know about
the internet!

Barry
-- 

In message <28f3e3834e.g4iat@demon.co.uk>, Barry Smith 
<baz@g4iat.demon.co.uk> writes
>In message <KH8rOGBaA2UFFwuP@apbz24.dial.pipex.com>
>          Duncan Kennedy <obg@nospamotterson-bg.couk> wrote:
>
>> First, a file called "robots.txt" (no quotes) in the root folder of your
>> site.  Just plain text with a variation on the following to suit your
>> whole site:
>
>snip detail.
>
>Many thanks for explaining that. I had assumed (wrongly) that
>the pages *not* linked from the main page would not be picked
>up by a search engine.
>
>The more I discover, the more I realise how little I know about
>the internet!
>
>Barry


:-)  So do we all - and I am one of the many who go back to Demon DOS 
days.  It was quite a shock to my client that not only were their (not 
very vital) staff information pages showing up in Google but so was a 
"new" ISP provided Guest Book (long gone) showing welcome messages and 
links from 10 or 12 porn sites!.  They had put in a robots.txt file but 
not the no-follow tag line on each page.
-- 
Duncan K
Downtown Dalgety Bay

In article "Password protection on some pages?" in
<demon.homepages.authoring>, on Thu, 9 Nov 2006
Duncan Kennedy <obg@nospamotterson-bg.couk> writes

[on robots.txt and meta-tags]

>Of course the purists will tell you this isn't safe but, for the 
>purpose, it actually works unless you have people determined enough

.... not just determined people.  Dont forget that both the robots file
and the no-follow meta tag (which are actually totally separate
features) are only treated as "advice" by search engines. They do not
actually *prevent* any search engine from indexing your pages "if it
wants to".

However, I think most reputable search engines do take the robots/meta
tags advice seriously.

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In message <GvxXtPBTKiVFFwla@mcrosolv.demon.co.uk>, David Gibson 
<david@[127.0.0.1]> wrote
[
> Dont forget that both the robots file
>and the no-follow meta tag (which are actually totally separate
>features) are only treated as "advice" by search engines. They do not
>actually *prevent* any search engine from indexing your pages "if it
>wants to".
>
If I have a subdirectory not linked to from another, how does a nosy 
search engine find it?
-- 
Andy
For Austria & its philately, Lupus, & much else visit
<URL:http://www.kitzbuhel.demon.co.uk/>

In message <H8pYQjEKUMVFFwEl@apbz24.dial.pipex.com>, Duncan Kennedy
<obg@nospamotterson-bg.couk> writes:
>I think we are probably talking at cross purposes here.  Yes the View
>Source will still show - although I seem to remember there is a way to
>prevent this, I can't remember how!

The usual way that some places try to do this sort of thing is:

- assume that the main menus in a web-browser will only do "View Source"
        for the top-level frame
- include the "real" page in a frame
- assume that the web-browser will provide a right-click context menu to
        "View Source" for a particular frame
- disable right-clicking[0].

Note, however, that Firefox (as one example) lets you easily configure
some of the stupidities that web-sites are allowed to do with
JavaScript.  In 1.5, that lets you play with resizing/moving existing
windows, raising windows, screwing with the status bar and... disabling
or replacing the context menu.  2.x has the same facilities, and it may
have more.

A number of other browsers have similar facilities.

Bottom-line: fucking with people's browsers using JavaScript pisses
people off, and they will often subvert attempts if you try it.



[0] One website I use had a habit of doing this to disable you from
"stealing" content, branding etc. by right-clicking and hitting "Save
Image" or "View Image" or whatever.[1][2]  It tried as hard as it could
to get you to have JavaScript on in the first place (pages not reloading
without JavaScript in the first place etc.).  Unfortunately, it had
intercepted pressing the right-click button only.  If you went left-
click and hold left-click, right-click and hold right-click, release
left-click, release right-click, the context menu appeared.  Apparently
a common mistake on some websites, IME.

[1] Leaving aside that you could just hit Print Screen, or the
equivalent on a number of other OSes.  It's worth bearing in mind that a
number of websites (and website users!) believe that disabling right-
click will stop you saving important or unfortunate content.

[2] Also, most of the major browsers I've used over the last couple of
years have had something like a "Save Complete Page..." option, where
every contained image etc. is saved of as a separate file automatically.

-- 
James Coupe
PGP Key: 0x5D623D5D             YOU ARE IN ERROR.
EBD690ECD7A1FB457CA2            NO-ONE IS SCREAMING.
13D7E668C3695D623D5D            THANK YOU FOR YOUR COOPERATION.

In message <+degNDdo+MWFFwYo@gratiano.zephyr.org.uk>, James Coupe 
<james@zephyr.org.uk> writes

[useful comments snipped]
>
>
>
>[2] Also, most of the major browsers I've used over the last couple of
>years have had something like a "Save Complete Page..." option, where
>every contained image etc. is saved of as a separate file automatically.
>
Yes - that is one way I was alluding to in previous messages.  I use 
that a lot with client's consent if I need to put their site on CD 
Business card. I have only come across one site that refuses to save 
*anything (OK much of it is on a database)  I haven't taken time to work 
out exactly how they *seem  manage to prevent at least *something but it 
is probably some variation on what you described.

In the case in question, were it not for the RISC OS that appears to be 
causing a problem, a simple password and the other options mentioned 
would be more than enough as no concerted effort to access the pages 
without password was envisaged and there would be nothing of value 
there.
-- 
Duncan K
Downtown Dalgety Bay

In message <TCN9AsIncKWFFw85@kitzbuhel.demon.co.uk>, Andy 
<andy@kitzbuhel.demon.co.uk> writes
>In message <GvxXtPBTKiVFFwla@mcrosolv.demon.co.uk>, David Gibson 
><david@[127.0.0.1]> wrote
>[
>> Dont forget that both the robots file
>>and the no-follow meta tag (which are actually totally separate
>>features) are only treated as "advice" by search engines. They do not
>>actually *prevent* any search engine from indexing your pages "if it
>>wants to".
>>
>If I have a subdirectory not linked to from another, how does a nosy 
>search engine find it?


I don't know for sure - I can guess that, having found the site, they 
wander about the root directory  and start digging into all 
sub-directories.  All I can say is that, in the case I mentioned, all 
the staff pages were there in Google (or was it Yahoo?) in all their 
glory.  When I had a look at the source code and directory structure, 
there *was a valid robots.txt in the root but no "nofollow noindex" tags 
in the individual files.  Putting them in cured the problem and they are 
no longer indexed anywhere I can find. (I.e. major search engines)

-- 
Duncan K
Downtown Dalgety Bay

In article "Password protection on some pages?" in
<demon.homepages.authoring>, on Mon, 13 Nov 2006
Andy <andy@kitzbuhel.demon.co.uk> writes

>[
>> Dont forget that both the robots file
>>and the no-follow meta tag (which are actually totally separate
>>features) are only treated as "advice" by search engines. They do not
>>actually *prevent* any search engine from indexing your pages "if it
>>wants to".
>>
>If I have a subdirectory not linked to from another, how does a nosy 
>search engine find it?

If its not linked *and* its name is "unguessable" *and* its name does
not appear in any other exposed file, it is probably safe.

But if you include a robots file saying "do not go to this sub-
directory" then you have immediately announced to the entire Internet
that that sub-directory exists!  

This might be why Duncan Kennedy found that he needed the meta tags as
well.  Perhaps the search engine didnt "obey" robots.txt, butr harvest
the URLs from it. But it did obey the meta tags. Thankfully.

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In article "Password protection on some pages?" in
<demon.homepages.authoring>, on Wed, 8 Nov 2006
Barry Smith <baz@g4iat.demon.co.uk> writes

>As the page I planned to protect will be predominantly for
>RISC OS users this isn't going to work.

You wrote that last week, and I cannot immediately recall the context,
but JavaScript is JavaScript and shouldnt depend on the OS, except to
the extent that some browsers in arcane operating systems might only
implement an older version of JavaScript :-)

Anyway.... never mind that. I have written a short demonstration of a
password-protection system in JavaScript. It wasnt as tedious as I
thought it was going to be.

It performs a simple hash of the password that is typed in, so that you
do not have to store the password in its original, clear form.  However,
that was just "an exercise" and is fairly pointless because, although
demo should be proof against any attack by determined search engines,
any human who reads the JavaScript file is going to be able to work out
the address of your private pages. The reason for this is that,
ultimately, the JavaScript has to say "go to this page", or in JS-speak,
location.href = private_pages.html

There are a total of six files in the demo and, when you eventually
manage to navigate to the private pages, you'll see a list of them.  

Firefox behaves slightly differently to MSIE - annoyingly so, in fact. 
I havent investigated why, but there are some comments in the
JavaScript.

Start off the adventure at http://caves.org.uk/js/demo/

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In message <6t$4NQBmxwWFFw66@mcrosolv.demon.co.uk>, Wed, 15 Nov 2006 
12:47:34, David Gibson <david@[127.0.0.1]> writes
>
>It performs a simple hash of the password that is typed in, so that you 
>do not have to store the password in its original, clear form. However, 
>that was just "an exercise" and is fairly pointless because, although 
>demo should be proof against any attack by determined search engines, 
>any human who reads the JavaScript file is going to be able to work out 
>the address of your private pages. The reason for this is that, 
>ultimately, the JavaScript has to say "go to this page", or in 
>JS-speak, location.href = private_pages.html

Not entirely so.

The Javascript can compute the address of the page, or of the directory 
in which the page resides, by an impenetrable and irreversible 
algorithm.

For example, DavidGibson encodes as "9iod33uxkihg" by the method in 
<URL:http://www.merlyn.demon.co.uk/js-other.htm#Pwdg>.

You may have to assume that your legitimate readers will not expose the 
coded version; but you have to assume anyway that they will not expose 
the clear version.  You can move the page while keeping the announced 
password, by changing the algorithm.

It might help to send them to a page such as "9iod33uxkihg.htm" which 
immediately redirects them to some other obscure page such as 
"kk6332hid2t2.htm" which checks where the browser came from and if 
incorrect redirects to a page of non-vulgar abuse.


But those who are smart enough to modify the script can cause the 
transformed password to be displayed.  Check, therefore, where the link 
has come from.

It's a good idea to read news:comp.lang.javascript and its FAQ.  See below.

-- 
  (c) John Stockton, Surrey, UK.  ?@merlyn.demon.co.uk   Turnpike v6.05   IE 6
  <URL:http://www.jibbering.com/faq/>? JL/RC: FAQ of news:comp.lang.javascript
  <URL:http://www.merlyn.demon.co.uk/js-index.htm> jscr maths, dates, sources.
  <URL:http://www.merlyn.demon.co.uk/> TP/BP/Delphi/jscr/&c, FAQ items, links.

In article "Password protection on some pages?" in
<demon.homepages.authoring>, on Wed, 15 Nov 2006
Dr J R Stockton <jrs@merlyn.demon.co.uk> writes

>>ultimately, the JavaScript has to say "go to this page", or in 
>>JS-speak, location.href = private_pages.html
>
>Not entirely so.
>
>The Javascript can compute the address of the page, or of the directory 
>in which the page resides, by an impenetrable and irreversible 
>algorithm.

OK. The key is "impenetrable", of course. :-)

I have added a demo of a scrambling of the URL to the page at 
http://caves.org.uk/js/demo/

>It might help to send them to a page such as "9iod33uxkihg.htm" which 
>immediately redirects them to some other obscure page such as 
>"kk6332hid2t2.htm" which checks where the browser came from and if 
>incorrect redirects to a page of non-vulgar abuse.

The problem of limiting ourselves to using JavaScript is that you end up
going around in circles.   Yes - you can check where the browser came
from, but not if JavaScript is turned off.

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In message <8PbZFtAzoCXFFwxJ@mcrosolv.demon.co.uk>, Thu, 16 Nov 2006 
09:06:59, David Gibson <david@[127.0.0.1]> writes

>>It might help to send them to a page such as "9iod33uxkihg.htm" which
>>immediately redirects them to some other obscure page such as
>>"kk6332hid2t2.htm" which checks where the browser came from and if
>>incorrect redirects to a page of non-vulgar abuse.
>
>The problem of limiting ourselves to using JavaScript is that you end up
>going around in circles.   Yes - you can check where the browser came
>from, but not if JavaScript is turned off.

But in that case you won't get there, and you already know where you 
are.

-- 
  (c) John Stockton, Surrey, UK.   ?@merlyn.demon.co.uk   Turnpike v6.05   MIME.
   <URL:http://www.merlyn.demon.co.uk/> TP/BP/Delphi/&c., FAQqy topics & links;
   <URL:http://www.merlyn.demon.co.uk/clpb-faq.txt>   RAH Prins : c.l.p.b mFAQ;
   <URL:ftp://garbo.uwasa.fi/pc/link/tsfaqp.zip> Timo Salmi's Turbo Pascal FAQ.

In article "Password protection on some pages?" in
<demon.homepages.authoring>, on Thu, 16 Nov 2006
Dr J R Stockton <jrs@merlyn.demon.co.uk> writes

>>The problem of limiting ourselves to using JavaScript is that you end up
>>going around in circles.   Yes - you can check where the browser came
>>from, but not if JavaScript is turned off.
>
>But in that case you won't get there, and you already know where you are.

Ah. Yes, that is a definite flaw in my argument :-)

But you could get there with JS on, and tell someone the URL you
discovered, or otherwise publish it. They could then get there with JS
*off*, without needing to know the password.  Ok ... unlikely scenario.

Actually, there is another flaw which is that not all browsers report
document.referrer (especially if blocked by a user-option in a security
program), so you cannot *rely* on JS being able to check where you'd
come from.
-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In message <fRoOLDBLUwUFFwN5@apbz24.dial.pipex.com>
          Duncan Kennedy <obg@nospamotterson-bg.couk> wrote:

> In message <b9a9bb824e.g4iat@demon.co.uk>, Barry Smith 
> <baz@g4iat.demon.co.uk> writes

Apologies for responding to this after such a long break.
I've been busy (amongst other things) "processing" pictures
of my sister's wedding in Gretna :-)

> >Using a browser called WebsterXL I get the panel to enter a
> >username and password but then get a javascript error.
> >Using Netsurf or Oregano2 it displays all the code!
> >Maybe I've made an error copying/pasting the coding. It
> >would be interesting to check this with a site that does
> >use this (or similar) javascript.
> >
> >As the page I planned to protect will be predominantly for
> >RISC OS users this isn't going to work.
> 
> I would be interested in what happens with the system I have used under 
> RISC browsers if you would care to experiment.  I haven't got a system 
> to check it with.  I *have checked with various Linux browsers. 
> Unfortunately there isn't anything on any of my sites using it at the 
> moment.

Is this still the case? I'm very happy to experiment for you if
it will give you some extra knowledge. I actually have 6 different
browsers I can try.

Regards

Barry
-- 

In message <6t$4NQBmxwWFFw66@mcrosolv.demon.co.uk>
          David Gibson <david@[127.0.0.1]> wrote:

Apologies for the delayed response.

> In article "Password protection on some pages?" in
> <demon.homepages.authoring>, on Wed, 8 Nov 2006
> Barry Smith <baz@g4iat.demon.co.uk> writes
> 
> >As the page I planned to protect will be predominantly for
> >RISC OS users this isn't going to work.
> 
> You wrote that last week, and I cannot immediately recall the context,
> but JavaScript is JavaScript and shouldnt depend on the OS, except to
> the extent that some browsers in arcane operating systems might only
> implement an older version of JavaScript :-)

That is the case with RISC OS although I'm not sure I agree with
the 'arcane' description :-)

My fastest browser (Netsurf, open source) doesn't have JavaScript at all
but works perfectly well for internet banking etc.

> Anyway.... never mind that. I have written a short demonstration of a
> password-protection system in JavaScript. It wasnt as tedious as I
> thought it was going to be.

snip

> Start off the adventure at http://caves.org.uk/js/demo/

I have downloaded the sources as suggested and will experiment when I
get some time. Don't hold your breath :-)

Thanks

Barry
-- 
NOTE: No trees were killed in the sending of this message,
but a large number of electrons were terribly inconvenienced.