Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password protect a static HTML page

github.com

Post reply on HN
Print view View original

161–170 of 294 posts

Re: Password protect a static HTML page

#161

Post by ipaddr »

tialaramex wrote: post #113
VoidWhisperer wrote: post #82

The downside to this method is that since the resulting cryptographic hash and salt have to be in the resulting file, so there is nothing stopping someone from pulling the hash/salt out and bruteforcing it locally (as opposed to being able to ratelimit login attempts on a server) if they are so inclined and have the required resources.. which may not be that much in the way of resources as the tool uses 1000 iteratio…

Right but all that's happening here is stretching. So the difference only matters in the middle. Regardless of the strategy bad guys will guess "1234" or "sesame" (too easy) and they won't guess a random 128-bit key I just generated with my hexadecimal dice (impossible). This weakness only means it's easier than expected to guess your password is "suckitelon" or "GoCowboys1978" or whatever We put a lot of effort into…

Your 128 key is difficult for users to enter manually.

Re: Password protect a static HTML page

#162

Post by Gordonjcp »

ipaddr wrote: post #159

Use apache to serve your page and htpasswd to provide basic authentication. Easy 1994 answer

I thought that too, but this appears like it works to password protect an html file that's *not* being served off a server. This ought to work with a file on disk too.

Re: Password protect a static HTML page

#163

Post by ipaddr »

bitexploder wrote: post #16

The use case for a document like this is a little different from .htaccess. This is something you can share, email, host, etc and have some security in transit and at rest. Yes, .htaccess password protects on the web server, but that is one specific use case and requires a lot of machinery and specific environment. JavaScript is everywhere. And this is a static HTML document in the sense that there is no server side…

Why not use a password protected word document if those are your use-cases?

Re: Password protect a static HTML page

#164

Post by aflag »

adamcharnock wrote: post #126

I saw a super simple example of this back in the 90s when I was first leaning web development (was in Web Development for Dummies or some such). The page prompted the user for the password, and then used the password to generate the URL for the hidden page and redirected the user there. Of course this wasn’t over HTTPS, and you got a 404 if you entered the wrong password, but it was still a neat hobbyist trick for th…

That was very popular back then. Besides the 404, it has the side effect that if that URL leaked, then your password system broke. With this implementation leaking the page is not a big deal (assuming you're not using it to store state secrets or anything like that)

Re: Password protect a static HTML page

#166

Post by denysvitali »

Yenrabbit wrote: post #63

Does anyone know of a way to do something like this but with OAuth? E.g. log in with GitHub to view these docs.

I'd say it's not possible in pure HTML + JS (as in, encryption/ access control performed entirely there).

The solution (with a server) is: https://oauth2-proxy.github.io/oauth2-proxy/

Re: Password protect a static HTML page

#167

Post by userbinator »

I'll echo the other sentiments here that I wouldn't consider this "static HTML", and I was expecting something about .htaccess. That said, this seems to be a strengthening of what used to be somewhat common "protection", namely variations consisting of:

- Password in plaintext in the source e.g. "if(password=='hunter2') ..."

- No correlation between password and page contents (either the content is merely hidden and shown when the password check succeeds, or lightly obfuscated/encrypted using key independent of knowing the password)

- Hiding content by using "display:none" or similar

Re: Password protect a static HTML page

#169

Post by userbinator »

Gordonjcp wrote: post #162
ipaddr wrote: post #159

Use apache to serve your page and htpasswd to provide basic authentication. Easy 1994 answer

I thought that too, but this appears like it works to password protect an html file that's *not* being served off a server. This ought to work with a file on disk too.

The more general solution is to use a password-protected archive.

Re: Password protect a static HTML page

#170

Post by creata »

ipaddr wrote: post #163
bitexploder wrote: post #16

The use case for a document like this is a little different from .htaccess. This is something you can share, email, host, etc and have some security in transit and at rest. Yes, .htaccess password protects on the web server, but that is one specific use case and requires a lot of machinery and specific environment. JavaScript is everywhere. And this is a static HTML document in the sense that there is no server side…

Why not use a password protected word document if those are your use-cases?

You definitely could. But I think there are more computers with web browsers than there are computers that can read encrypted Microsoft Word documents.
Post reply on HN