Password protection

[Mike Painter]

I need a scheme to give people password access to JavaScript quizzes that
I have.
I've done a lot of programming but almost no JS.

Probably one password per person for each of five tests.

I suspect I will be maintaining the lists but if there is a *very* easy
routine that an end user could use it would be nice.
It usually takes more than five visits to get this guy up on anything new.

Any ideas where I might find such a beast?
I've been looking but with little luck so far.

[HikksNotAtHome]

In article <d6***********************@bgtnsc05-news.ops.worldnet.att.net>,
"Mike Painter" <md*********@att.net> writes:

I need a scheme to give people password access to JavaScript quizzes that
I have.
I've done a lot of programming but almost no JS.

Use a server side language (PHP, ASP, Server Side Javascript, etc.) Anything
you try to do in the browser, with regards to multiple users/passwords, will
fail.

Although Jim Ley showed me a page that is "password protected" that is pretty
spiffy. I have yet to break it. But, it doesn't contain the password in the
page, the password is a key to decrypting the page.

If the password is in the page, then it can/will be broken, and quite easily.
--
Randy

[Mike Painter]

"HikksNotAtHome" <hi************@aol.com> wrote in message
news:20***************************@mb-m10.aol.com...

In article <d6***********************@bgtnsc05-news.ops.worldnet.att.net>,
"Mike Painter" <md*********@att.net> writes:

I need a scheme to give people password access to JavaScript quizzes thatI have.
I've done a lot of programming but almost no JS.
Use a server side language (PHP, ASP, Server Side Javascript, etc.)

Anything you try to do in the browser, with regards to multiple users/passwords, will fail.

Although Jim Ley showed me a page that is "password protected" that is pretty spiffy. I have yet to break it. But, it doesn't contain the password in the page, the password is a key to decrypting the page.

If the password is in the page, then it can/will be broken, and quite

easily.

Granted if the person is willing to work at it and has the skills and the
password is in the page and they can see the page and the encryption is
simple enough they can break it.

For that type I would probably use the simplest method I've seen and use the
name of the file as the password. Assuming they can't see what's on the
server that's about as secure as you can get.

99.999% of the people who will be taking these quizzes would be better off
studying or looking the answers up in the book.

[Laurent Bugnion, GalaSoft]

Hi,

Mike Painter wrote:

"HikksNotAtHome" <hi************@aol.com> wrote in message
news:20***************************@mb-m10.aol.com...

In article <d6***********************@bgtnsc05-news.ops.worldnet.att.net>,
"Mike Painter" <md*********@att.net> writes:

I need a scheme to give people password access to JavaScript quizzes
that
I have.
I've done a lot of programming but almost no JS.

Use a server side language (PHP, ASP, Server Side Javascript, etc.)

Anything

you try to do in the browser, with regards to multiple users/passwords,

will

fail.

Although Jim Ley showed me a page that is "password protected" that is

pretty

spiffy. I have yet to break it. But, it doesn't contain the password in

the

page, the password is a key to decrypting the page.

If the password is in the page, then it can/will be broken, and quite

easily.

Granted if the person is willing to work at it and has the skills and the
password is in the page and they can see the page and the encryption is
simple enough they can break it.

For that type I would probably use the simplest method I've seen and use the
name of the file as the password. Assuming they can't see what's on the
server that's about as secure as you can get.

99.999% of the people who will be taking these quizzes would be better off
studying or looking the answers up in the book.

Then don't password protect them. If you do, you insult the intelligence
of those who are able to find the password. Just let them be responsible
for their own failure if they choose to look for the answers in the
page. It's not your problem anymore.

Anything you do on the client (even your file name = password trick) can
be easily defeated.

Laurent
--
Laurent Bugnion, GalaSoft
Webdesign, Java, javascript: http://www.galasoft-LB.ch
Private/Malaysia: http://mypage.bluewin.ch/lbugnion
Support children in Calcutta: http://www.calcutta-espoir.ch

[Jerry Park]

Laurent Bugnion, GalaSoft wrote:

Hi,

Mike Painter wrote:

"HikksNotAtHome" <hi************@aol.com> wrote in message
news:20***************************@mb-m10.aol.com...

In article
<d6***********************@bgtnsc05-news.ops.worldnet.att.net>,
"Mike Painter" <md*********@att.net> writes:
I need a scheme to give people password access to JavaScript quizzes

that

I have.
I've done a lot of programming but almost no JS.
Use a server side language (PHP, ASP, Server Side Javascript, etc.)

Anything

you try to do in the browser, with regards to multiple users/passwords,

will

fail.

Although Jim Ley showed me a page that is "password protected" that is

pretty

spiffy. I have yet to break it. But, it doesn't contain the password in

the

page, the password is a key to decrypting the page.

If the password is in the page, then it can/will be broken, and quite

easily.

Granted if the person is willing to work at it and has the skills and the
password is in the page and they can see the page and the encryption is
simple enough they can break it.

For that type I would probably use the simplest method I've seen and
use the
name of the file as the password. Assuming they can't see what's on the
server that's about as secure as you can get.

99.999% of the people who will be taking these quizzes would be better
off
studying or looking the answers up in the book.

Then don't password protect them. If you do, you insult the intelligence
of those who are able to find the password. Just let them be responsible
for their own failure if they choose to look for the answers in the
page. It's not your problem anymore.

Anything you do on the client (even your file name = password trick) can
be easily defeated.

Laurent

Actually, you can use javascript to securely password protect a page.
But the effort to maintain such a page is excessive.

[HikksNotAtHome]

In article <ix*****************@bignews6.bellsouth.net>, Jerry Park
<No*****@No.Spam> writes:

Actually, you can use javascript to securely password protect a page.
But the effort to maintain such a page is excessive.

And have the password in the page? Or are you referring to something like Jim
gave me? I can't find the link but the password was the key to the crypto. If
the password is in the page, its trivial to defeat it though.
--
Randy

[Mike Painter]

"HikksNotAtHome" <hi************@aol.com> wrote in message
news:20***************************@mb-m14.aol.com...

In article <ix*****************@bignews6.bellsouth.net>, Jerry Park
<No*****@No.Spam> writes:

Actually, you can use javascript to securely password protect a page.
But the effort to maintain such a page is excessive.
And have the password in the page? Or are you referring to something like

Jim gave me? I can't find the link but the password was the key to the crypto. If the password is in the page, its trivial to defeat it though.
--
Randy

Assume these lines are in the body of the text:
***********
It may seem easy for some to find a password. However for most people the
job can be very difficult. At some point the user will give up before
finding it.
This especially true if the pages include files that don't appear on the
page.
***********
What is the password? (And it's not password?)

[Mike Painter]

"Laurent Bugnion, GalaSoft" <galasoft-LB@bluewin_NO_SPAM.ch> wrote in
message news:bk**********@rex.ip-plus.net...

Hi,
<snip>
Anything you do on the client (even your file name = password trick) can
be easily defeated.

How can it be easily defeated?

[HikksNotAtHome]

In article <Qd***********************@bgtnsc04-news.ops.worldnet.att.net>,
"Mike Painter" <md*********@att.net> writes:

Assume these lines are in the body of the text:
***********
It may seem easy for some to find a password. However for most people the
job can be very difficult. At some point the user will give up before
finding it.
This especially true if the pages include files that don't appear on the
page.
***********
What is the password? (And it's not password?)

OK, let me clarify what I said, so we aren't splitting words. If the password
is in the code, and defined as the password, then its trivial to defeat.
Meaning, you can obfuscate it, but if its defined in the code as being the
password, so that script can compare what the user inputs to it, then its
trivial to defeat.

Can you make it hard enough that most people will give up? Sure. Can you make
it impossible? Not if the password is defined in the code as being the password
(The crypto page doesn't have it defined in the page, its used as the key to
the crypto).

If you want a secure system, do it on the server. And not even that is entirely
"secure" but it beats the heck out of javascript security.
--
Randy

[Laurent Bugnion, GalaSoft]

Hi,

Mike Painter wrote:

"Laurent Bugnion, GalaSoft" <galasoft-LB@bluewin_NO_SPAM.ch> wrote in
message news:bk**********@rex.ip-plus.net...

Hi,
<snip>
Anything you do on the client (even your file name = password trick) can
be easily defeated.

How can it be easily defeated?

Some browsers allow seeing everything on your server. It's then pretty
easy to find all the files it contains, and to load them.

If you have access to the server, it's very easy to set up password
protected directories for your users, and this way is much safer than
anything you can do on the client. Check htaccess in Google for details.
Of course, any security scheme can be defetaed eventually, but at least
you won't look like a fool for doing it on the client ;-)

Laurent
--
Laurent Bugnion, GalaSoft
Webdesign, Java, javascript: http://www.galasoft-LB.ch
Private/Malaysia: http://mypage.bluewin.ch/lbugnion
Support children in Calcutta: http://www.calcutta-espoir.ch

[Mike Painter]

"Laurent Bugnion, GalaSoft" <galasoft-LB@bluewin_NO_SPAM.ch> wrote in
message news:3f********@news.bluewin.ch...

Hi,

Mike Painter wrote:

"Laurent Bugnion, GalaSoft" <galasoft-LB@bluewin_NO_SPAM.ch> wrote in
message news:bk**********@rex.ip-plus.net...

Hi,
<snip>
Anything you do on the client (even your file name = password trick) can
be easily defeated.

How can it be easily defeated?

Some browsers allow seeing everything on your server. It's then pretty
easy to find all the files it contains, and to load them.

No, some servers allow seeing everything. The browser can't over ride that.

If you have access to the server, it's very easy to set up password
protected directories for your users, and this way is much safer than
anything you can do on the client. Check htaccess in Google for details.
Of course, any security scheme can be defetaed eventually, but at least
you won't look like a fool for doing it on the client ;-)

True enough but it does not solve the problem of multiple users with
passwords gaining access to those protected directories.
..htaccess works fine if I want *a* password.

My original post asked for references to a solution which might be JS, not
a rehash of things that don't meet the criteria.

The MS Access groups offer solutions, so far I've seen nothing here but
people saying how easy it is to break code and figure things out.

But when I ask how, they all fall silent. I'll look elsewhere.