Hiding my javascript

**Zoe Brown** · Sep 19 '05, 09:35 PM

Re: Hiding my javascript

"Simon Wigzell" <simonwigzell@s haw.ca> wrote in message news:cfFXe.5242 75$s54.368146@p d7tw2no...
I have developed a javascript application that can be used by my clients just by inserting the following in one of their web pages:

<script>
document.write( '<iframe src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>

Anyone looking at the page containing the above will only see the the above lines, not all the javascript source. Someone with a little more savy though could just paste http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their browser and then they will see the javascript.

Is there some way that my PGSampleTable.a sp could know it has been called from outside the iframe and then just not serve the javascript?

passing a parameter ???

**Randy Webb** · Sep 19 '05, 09:45 PM

Re: Hiding my javascript

Simon Wigzell said the following on 9/19/2005 4:32 PM:
[color=blue]
> I have developed a javascript application that can be used by my clients
> just by inserting the following in one of their web pages:
>
> <script>
> document.write( '<iframe
> src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
> </script>[/color]

And if JS is disabled or not present? Then the app is broken.
[color=blue]
> Anyone looking at the page containing the above will only see the the
> above lines, not all the javascript source. Someone with a little more
> savy though could just paste
> http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their
> browser and then they will see the javascript.[/color]

Yep, thats how the web works.
[color=blue]
> Is there some way that my PGSampleTable.a sp could know it has been
> called from outside the iframe and then just not serve the javascript?[/color]

No.
[color=blue]
> Any other way to hide your javascript?[/color]

Delete it from your hard drive, delete it from your servers, then it
can't be seen. If it's on a website, it can be seen.

[color=blue]
> (The above is only a prototype, it will eventually be a full costing
> system for the printing industry - I don't want anyone else to be able
> to steal it!)[/color]

Then don't deploy it on the web. And do not fall prey to the likes of
people who will attempt to tell you that the commercial product they
sell can do what you want, it can't. Ira Baxter is the first name that
comes to mind.

But, I do not even need to load it independently, I only need to know
how to read the source from my cache while the pages is open and you can
not stop that.

If someone manages to tell you that "obfuscatio n" will help you, try the
obfuscation on a test page, open it in IE, then paste this into the toolbar:

javascript:'<co de><ol><li>'+(d ocument.documen tElement||docum ent.body).outer HTML.replace(/&/g,"&").repl ace(/</g,"<").repla ce(/%20%20/g," %20"). replace(/(\n\r?|\r)/g,"<li>")+'<\/ol><\/code>';

And press GO and find out how "safe" your code is.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq & newsgroup weekly

**Simon Wigzell** · Sep 19 '05, 09:45 PM

Re: Hiding my javascript

"Zoe Brown" <zoenaomibrown@ N-O-S-P-A-A-Mtesco.net> wrote in message news:r6GXe.1408 7$QU3.6710@news fe1-win.ntli.net...

"Simon Wigzell" <simonwigzell@s haw.ca> wrote in message news:cfFXe.5242 75$s54.368146@p d7tw2no...
I have developed a javascript application that can be used by my clients just by inserting the following in one of their web pages:

<script>
document.write( '<iframe src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
</script>

Anyone looking at the page containing the above will only see the the above lines, not all the javascript source. Someone with a little more savy though could just paste http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their browser and then they will see the javascript.

Is there some way that my PGSampleTable.a sp could know it has been called from outside the iframe and then just not serve the javascript?

passing a parameter ???

No, the parameter would be visible in the source.

**alu** · Sep 20 '05, 03:05 AM

Re: Hiding my javascript

[color=blue]
> "Simon Wigzell" <simonwigzell@s haw.ca> wrote
> Is there some way that my PGSampleTable.a sp could know it has been called[/color]
from outside the iframe and then just not serve the javascript?

-------------------------------------------------------
It's basically impossible to hide script (probably a good thing),
but to make it a bit more difficult to access casually,
within PGSampleTable.a sp <head> you could insert a kickout;
something like:

if (self == parent) {self.location. href="parentpag e.html"}

// or some other variation

if (self == top) {top.location.h ref = "parentpage.htm l"}

------------------------------------------------------

It's not foolproof of course (disabling javascript will still give anyone
access).
For fun, I've converted entire scripts to hex, but really,
anyone with patience can decode it.
-alu

**Vladdy** · Sep 20 '05, 03:05 AM

Re: Hiding my javascript

Simon Wigzell wrote:[color=blue]
> I have developed a javascript application that can be used by my clients
> just by inserting the following in one of their web pages:
>
> <script>
> document.write( '<iframe
> src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
> </script>
>
> Anyone looking at the page containing the above will only see the the
> above lines, not all the javascript source. Someone with a little more
> savy though could just paste
> http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their
> browser and then they will see the javascript.
>
> Is there some way that my PGSampleTable.a sp could know it has been
> called from outside the iframe and then just not serve the javascript?
>
> Any other way to hide your javascript? (The above is only a prototype,
> it will eventually be a full costing system for the printing industry -
> I don't want anyone else to be able to steal it!)
>
>[/color]
In addition to what Randy posted:
If you consider your formulas of any value - do your calculations
server side. Also better from accessibility standpoint.

--
Vladdy

http://www.klproductions.com

**Dr Clue** · Sep 20 '05, 09:06 AM

Re: Hiding my javascript

Simon Wigzell wrote:[color=blue]
> I have developed a javascript application that can be used by my clients
> just by inserting the following in one of their web pages:
>
> <script>
> document.write( '<iframe
> src="http://www.dynamicwebs itesystems.com/PGSampleTable.a sp"></iframe>')
> </script>
>
> Anyone looking at the page containing the above will only see the the
> above lines, not all the javascript source. Someone with a little more
> savy though could just paste
> http://www.dynamicwebsitesystems.com/PGSampleTable.asp into their
> browser and then they will see the javascript.
>
> Is there some way that my PGSampleTable.a sp could know it has been
> called from outside the iframe and then just not serve the javascript?
>
> Any other way to hide your javascript? (The above is only a prototype,
> it will eventually be a full costing system for the printing industry -
> I don't want anyone else to be able to steal it!)[/color]

Offiscation could be interesting. Heres a variation on something
I've used before

When the browser first fetches

http://www.dynamicwebsitesystems.com/PGSampleTable.asp

with no arguments have it output something like

<script>
var szSerialNo="SN" ;for(i in top){ee=eval("t op."+i);
if(typeof ee=='number')sz SerialNo+=ee+St ring(i).substri ng(0,1);}
document.locati on.href=documen t.location.href +"?"+szSeria lNo
</script>

This will result in a second call something like

http://www.dynamicwebsitesystems.com/PGSampleTable.asp?SN105s0l4s

Now depending on this value you can send back script for your
application or a fake script for the nozy to stare at.

The reason to have a fake script is to keep the curious
from realizing what exactly you did.

The clue for your asp script is checking for the presence
of "0l" That's the number "1" fallowed by the lowercase
letter "L" in the faux serial number. This indicates no frames

There are more things you can do to verify the serial number
but the idea is not to let the nozy person know what your looking for.

--
--.
--=<> Dr. Clue (A.K.A. Ian A. Storms) <>=-- C++,HTML, CSS,Javascript
--=<> http://resume.drclue.net <>=-- AJAX, SOAP, XML, HTTP
--=<> http://www.drclue.net <>=-- SERVLETS,TCP/IP, SQL
--.

**Dr Clue** · Sep 20 '05, 09:06 AM

Re: Hiding my javascript

Dr Clue wrote:
[color=blue]
> The clue for your asp script is checking for the presence
> of "0l" That's the number "1" fallowed by the lowercase
> letter "L" in the faux serial number. This indicates no frames[/color]

typeo , that should be

( "0l" That's the number "0" fallowed by the lowercase "l" )

--
--.
--=<> Dr. Clue (A.K.A. Ian A. Storms) <>=-- C++,HTML, CSS,Javascript
--=<> http://resume.drclue.net <>=-- AJAX, SOAP, XML, HTTP
--=<> http://www.drclue.net <>=-- SERVLETS,TCP/IP, SQL
--.

**Boobie** · Sep 20 '05, 04:15 PM

Re: Hiding my javascript

"Simon Wigzell"[color=blue][color=green]
>>Any other way to hide your javascript? (The above is only a prototype,
>>it will eventually be a full costing system for the printing industry - I[/color][/color]
don't want anyone else to be able to steal it!)

geesh what's the big deal...if you have to ask this q
your stuff aint sophisticated enough to be worth "stealing"

**Dr John Stockton** · Sep 20 '05, 10:45 PM

Re: Hiding my javascript

JRS: In article <PTKXe.7183$LV5 .7178@trndny02> , dated Tue, 20 Sep 2005
02:56:47, seen in news:comp.lang. javascript, Vladdy
<vlad@klproduct ions.com> posted :
[color=blue]
> If you consider your formulas of any value - do your calculations
>server side. Also better from accessibility standpoint.[/color]

Not necessarily. A page with reader-side calculation can be fetched and
later operated off-line, and operating off-line is becoming more
important as the number of portable computers increases.

--
© John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Turnpike v4.00 IE 4 ©
<URL:http://www.jibbering.c om/faq/> JL/RC: FAQ of news:comp.lang. javascript
<URL:http://www.merlyn.demo n.co.uk/js-index.htm> jscr maths, dates, sources.
<URL:http://www.merlyn.demo n.co.uk/> TP/BP/Delphi/jscr/&c, FAQ items, links.

**Richard Cornford** · Sep 21 '05, 01:05 AM

Re: Hiding my javascript

Dr Clue wrote:
<snip>[color=blue]
> <script>
> var szSerialNo="SN" ;for(i in top){ee=eval("t op."+i);
> if(typeof ee=='number')sz SerialNo+=ee+St ring(i).substri ng(0,1);}
> document.locati on.href=documen t.location.href +"?"+szSeria lNo
> </script>
>
> This will result in a second call something like
> http://www.dynamicwebsitesystems.com...asp?SN105s0l4s
>
> Now depending on this value you can send back script for
> your application or a fake script for the nozy to stare at.
>
> The reason to have a fake script is to keep the curious
> from realizing what exactly you did.[/color]
<snip>[color=blue]
> There are more things you can do to verify the serial number
> but the idea is not to let the nozy person know what your
> looking for.[/color]

Given that pulling the files actually downloaded from the browser's
cache is a fairly normal strategy for examining complete 3rd party
scripts, this will be a less than successful strategy.

But since Simon Wigzell frequently asks trivial questions on this group
it is likely that his expectation of interest in his script greatly
exceeds reality, and that much of that script is not actually his own
work anyway.

Richard.

**Dr Clue** · Sep 21 '05, 01:25 AM

Re: Hiding my javascript

Richard Cornford wrote:[color=blue]
> Dr Clue wrote:[/color]
<snip>[color=blue]
> Given that pulling the files actually downloaded from the browser's
> cache is a fairly normal strategy for examining complete 3rd party
> scripts, this will be a less than successful strategy.[/color]

I think the key word in my response was "Offiscatio n".
Of course one could do so even further by getting
the scripts via post , fiddling with the cache headers
and having faux versions of key functions that overlay
one another.

But heck , much of this stuff is like cheap bicycle locks,
in that they are meant to discourage theft, but can hardly prevent it.

--
--.
--=<> Dr. Clue (A.K.A. Ian A. Storms) <>=-- C++,HTML, CSS,Javascript
--=<> http://resume.drclue.net <>=-- AJAX, SOAP, XML, HTTP
--=<> http://www.drclue.net <>=-- SERVLETS,TCP/IP, SQL
--.

**Richard Cornford** · Sep 21 '05, 01:55 AM

Re: Hiding my javascript

Dr Clue wrote:[color=blue]
> Richard Cornford wrote:[color=green]
>> Dr Clue wrote:[/color]
> <snip>[color=green]
>> Given that pulling the files actually downloaded from the
>> browser's cache is a fairly normal strategy for examining
>> complete 3rd party scripts, this will be a less than
>> successful strategy.[/color]
>
> I think the key word in my response was "Offiscatio n".
> Of course one could do so even further by getting
> the scripts via post , fiddling with the cache headers[/color]

If it is in the browser it is in the browser's cache, so post requests
and fiddling with headers will make no difference (except that implied
need to repeatedly download the same script would represent a needless
(and pointless) performance hit).
[color=blue]
> and having faux versions of key functions that overlay
> one another.[/color]

But given the full set of scripts and HTML (and images, etc) from the
cache it is not that difficult to work out what is going on.
[color=blue]
> But heck , much of this stuff is like cheap bicycle locks,
> in that they are meant to discourage theft, but can hardly
> prevent it.[/color]

If you use a cheep bicycle lock in London your bicycle _will_ be stolen,
no question about it (unless it is self evidently such a wreck that an
observer would not believe it was even functional).

The whole obfuscation business is protection against individuals who
don't know enough to actually have a use for any script they discover.
Once they have learnt to understand and use any script they may find
they have learnt enough to defeat any 'protection'. After all, the
ability to search with google is pretty much all that is required.

Richard.

**Dr Clue** · Sep 21 '05, 08:55 AM

Re: Hiding my javascript

Richard Cornford wrote:[color=blue]
> Dr Clue wrote:[/color]
<snip[color=blue][color=green]
>>But heck , much of this stuff is like cheap bicycle locks,
>>in that they are meant to discourage theft, but can hardly
>>prevent it.[/color]
>
> If you use a cheep bicycle lock in London your bicycle _will_ be stolen,
> no question about it (unless it is self evidently such a wreck that an
> observer would not believe it was even functional).[/color]

Thats exactly why the asp script would return the
faux code (crappy bike).

This faux code would would have enough code to look genuine
perhaps having deliberately flawed yet running functions.

So as far as the person doing a view-source , is concerned
they've stolen my crappy bike, and have no reason to suspect
that the crappy bike is a sham that hides my good bike.

--
--.
--=<> Dr. Clue (A.K.A. Ian A. Storms) <>=-- C++,HTML, CSS,Javascript
--=<> http://resume.drclue.net <>=-- AJAX, SOAP, XML, HTTP
--=<> http://www.drclue.net <>=-- SERVLETS,TCP/IP, SQL
--.

Hiding my javascript

Hiding my javascript

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment