<story><title>Show HN: Password-protect a static HTML page</title><url>https://robinmoisson.github.io/staticrypt</url></story><parent_chain><item><author>joekrill</author><text>From the way we&amp;#x27;ve seen most schools respond to these types of reports from students you have to wonder if you were lucky that you couldn&amp;#x27;t figure out how to report it!</text></item><item><author>roywiggins</author><text>In highschool I realized that my school&amp;#x27;s grading system was using a javascript scheme to control access to grades online:&lt;p&gt;1. Concatenate the username and password, hash the combination&lt;p&gt;2. Name the HTML file with the grades using that hash&lt;p&gt;3. When the user logs in, calculate the hash in Javascript and redirect to that HTML page.&lt;p&gt;In theory, you can only work out the URL of the page if you have the username and password in hand. I&amp;#x27;m sure it was pretty trivially bruteforcable, but aside from that it seemed sort of okay.&lt;p&gt;Until I realized that directory listings were turned on, and the directory that had all the HTML files sometimes had no index.html, thereby rendering the entire obfuscation scheme moot.&lt;p&gt;(n.b. I was too ethical to use this to peek at anyone&amp;#x27;s grades! I did try to report it but it was never clear to whom to report it to, and since every teacher generated these files using their own copy of the program, there was no obvious central place to report this to. A couple of years later online grades were centralized into a different system)</text></item></parent_chain><comment><author>roywiggins</author><text>The time I accidentally took down the entire school website, I luckily did it at school and immediately told my understanding math teacher, who told IT directly, who came and asked me what I&amp;#x27;d done, and fixed it within a couple minutes.&lt;p&gt;In retrospect I dodged a huge bullet!</text></comment>
<story><title>Show HN: Password-protect a static HTML page</title><url>https://robinmoisson.github.io/staticrypt</url></story><parent_chain><item><author>joekrill</author><text>From the way we&amp;#x27;ve seen most schools respond to these types of reports from students you have to wonder if you were lucky that you couldn&amp;#x27;t figure out how to report it!</text></item><item><author>roywiggins</author><text>In highschool I realized that my school&amp;#x27;s grading system was using a javascript scheme to control access to grades online:&lt;p&gt;1. Concatenate the username and password, hash the combination&lt;p&gt;2. Name the HTML file with the grades using that hash&lt;p&gt;3. When the user logs in, calculate the hash in Javascript and redirect to that HTML page.&lt;p&gt;In theory, you can only work out the URL of the page if you have the username and password in hand. I&amp;#x27;m sure it was pretty trivially bruteforcable, but aside from that it seemed sort of okay.&lt;p&gt;Until I realized that directory listings were turned on, and the directory that had all the HTML files sometimes had no index.html, thereby rendering the entire obfuscation scheme moot.&lt;p&gt;(n.b. I was too ethical to use this to peek at anyone&amp;#x27;s grades! I did try to report it but it was never clear to whom to report it to, and since every teacher generated these files using their own copy of the program, there was no obvious central place to report this to. A couple of years later online grades were centralized into a different system)</text></item></parent_chain><comment><author>Natsu</author><text>When I found a way to bypass the login process back in university and thereby gain access to the previous users&amp;#x27; network storage in university, I reported it anonymously for that very reason.</text></comment>