testing 2.1

rejetto · **Reply #165 on:** July 07, 2006, 12:42:09 PM

the point is not about having 50% or more users using that feature.
it is actually a sensible usability improvement.
of course it will be an option.
anyway, feature accepted.

ruudboek · **Reply #166 on:** July 07, 2006, 02:03:36 PM

@rejetto

I really appreciate this

What it your point of view on making HFS only add "username:password@" at the point that HFS is triggered to start serving a download?
That should then not make "username:password@" visible in the address bar or status bar.
Do you think that that is technically achievable?

Ruud

rejetto · **Reply #167 on:** July 07, 2006, 04:11:09 PM

impossibile. the link is in the page. the page is generated and displayed before you know what the user will download.

Anonymous · **Reply #168 on:** July 07, 2006, 11:01:12 PM

Quote from: "rejetto"

anyway, feature accepted.

If username and password is visible in plain text, you are creating a HFS security issue. Without encryption of some sort, the information can be seen by other people while it is in transit.

ruudboek · **Reply #169 on:** July 07, 2006, 11:56:36 PM

Quote from: "rejetto"

impossibile. the link is in the page. the page is generated and displayed before you know what the user will download.

Is then maybe possible to add "username:password@" during the generation of the page, so that all links to files will include "username:password@"?

Ruud

rejetto · **Reply #170 on:** July 08, 2006, 02:26:27 PM

Quote from: "Anonymous"

Quote from: "rejetto"
anyway, feature accepted.

If username and password is visible in plain text, you are creating a HFS security issue. Without encryption of some sort, the information can be seen by other people while it is in transit.

1. it is optional
2. many people have the computer in a room with enough privacy

usability and security are often conflicting, anyone who studied security knows it.

rejetto · **Reply #171 on:** July 08, 2006, 02:27:22 PM

Quote from: "ruudboek"

Quote from: "rejetto"
impossibile. the link is in the page. the page is generated and displayed before you know what the user will download.

Is then maybe possible to add "username:password@" during the generation of the page, so that all links to files will include "username:password@"?

yes, that's what i meant saying "accepted"

MarkV · **Reply #172 on:** July 08, 2006, 10:17:00 PM

@rejetto: Do you have the possibility to use obfuscation of username and password by using the "%" values? Just a thought.

All modern browsers/dl managers convert it by itself.

The most famous example for such a "%" value is the %20 which represents a space.

Makes it harder to spy passwords fast...

MarkV

rejetto · **Reply #173 on:** July 09, 2006, 11:54:56 AM

yes, it works, i tested with IE+DAP.

ants · **Reply #174 on:** July 17, 2006, 03:13:19 PM

Any progress news Rejetto?

rejetto · **Reply #175 on:** July 19, 2006, 01:49:29 AM

no, been busy with my exam.
now done.
i have some maintenance to do to forum and wiki.

segosa · **Reply #176 on:** July 19, 2006, 06:43:51 PM

I can't find where to disable the feature whereby the username/password is embedded in the page's urls... where is it?

rejetto · **Reply #177 on:** July 19, 2006, 06:59:08 PM

if you are referring to what we are discussing about, it is a thing to come, there is nothing you should disable

segosa · **Reply #178 on:** July 20, 2006, 06:12:30 AM

If I visit the URL with the password embedded into it, for example http://user:pass@localhost, all links on the page will also have user:pass embedded into them. There's no way to disable that? Reading the past few pages it seems you've been discussing that exact feature and you said it was optional. Or do you mean that the ability to disable it is what's to come?

maverick · **Reply #179 on:** July 20, 2006, 07:36:03 AM

Quote from: "segosa"

If I visit the URL with the password embedded into it, for example http://user:pass@localhost, all links on the page will also have user:pass embedded into them. There's no way to disable that?

If you manually input that kind of url in the location field of your browser, that is the normal behavior. If you want to stop that behavior, login properly. Using your example, login using only http://localhost as the url (with of course HFS running). You will be prompted for username and password and they won't show up in the url.

Quote

Reading the past few pages it seems you've been discussing that exact feature and you said it was optional. Or do you mean that the ability to disable it is what's to come?

Yes, that type of scenerio has been discussed, but rejetto didn't implement it. You didn't finish reading the thread. It would be an optional feature, iF[/i] it was implemented.