Guest book security with C# and MS SQL

Ken Barrett

17y36.7k.NET

I'm actually not sure where this question belongs.

I'm developing a guest book for my web site and am concerned about security. I don't want a bunch of spam or nonsense written to my guest book by way of some automated nasty-ware.

Typically the security I see uses images of letters and numbers that the visitor must duplicate before access is granted.

The way I'm envisioning doing this is through an array of images that rotate on the web site and a parallel array of what the decryption is. Seems simple enough (although I haven't started coding yet, and we all know how perceived simplicity can change as a project is fleshed out).

Ok finally, here's my question.

Why are images used?

Using JavaScript I can easily render a random string of characters to the browser that won't show up in the html or be available through "View source" and authenticate it also using JavaScript (hmm I have to think a bit about that authentication..) before it is submitted.

Has anyone out there tried this approach? All of my db backed apps have been behind firewalls with my company, so this is my first foray into the outside world and I want to do my best to be prepared.

TIA
Ken

5 Replies

Know the answer? Post it — somebody with the same question will find it here.

Roei Bar17y ago
Accepted answer
dude, anything that is being rendered in Client Side can be grabed and manipulated
for example by using Paros as a proxy, i can hold the js command and manipulate the request code
0
Ken Barrett17y ago
.. really? .. and here I thought the threat came from web crawlers that looked at the html. So they are some how intercepting the data as it is rendered? Interesting. Any suggestions for further reading on this? If they are able to see the rendered data, are they also able to see the content of images?

TIA
Ken
0
Ken Barrett17y ago
Actually it seems as if verification is simple, and I don't see how anyone can grab the security code even if the javascript is embedded in the html doc.

Here is a test html page I whipped together to verify this. Please give your opinions.. I much value them.

Check this :

                      "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

        content="text/html; charset=iso-8859-1" />
        content="Ken Barrett" />
JavaScript test security













      Enter the letters above here




                   onclick="evalSecure();" />




0
Ken Barrett17y ago
I have to say thanks much for the reply. Would you mind if I learn by exploring this idea with you?

If I use an external javascript file so it can't be seen, that looks something like this :

function setSecure() {
var s = document.getElementById('secure') ;
var a = ['A','B','C','D','E','F','H','J'] ; // just a subset of the alphabet for testing purposes
var word = "" ;
for(var i=0 ; i<5 ; i++) { // a 5 digit security code
var num = Math.floor(Math.random()*9+1) ;
word += a[num] ;
}
s.innerHTML = word ;

and the html document has this element :

Wouldn't that work?

The problem I see is the verification process...
0
Roei Bar17y ago
well, the idea of using images is that you set up validity time that is much less then the needed amount of time to run a program to be able to understand the word and write it down, it is impossible for robot apps to do that in such a short period of time, if you only run javascript any robot that will learn this action will be able to hack the encryption and submit garbage in your system.
0


Enter the letters above here
onclick="evalSecure();" />