Member Avatar for bibbleonline

I tryed the

<script language="JavaScript">var password;var pass1="PASSWORD-HERE";password=prompt('Whats The Magic Word?',' ');if (password==pass1) alert('That Is Correct!');else {  window.location="SITE-LINK";}</script>

code, but the problem i found is, that anyone can see what text has been typed into the passord box, can anyone tell me how you get the text to appear as bullet marks like i have seen on other sites?

Edited by peter_budo because: Keep It Organized - For easy readability, always wrap programming code within posts in [code] (code blocks)
  • 3 Contributors
  • 5 Replies
  • 82 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by peter_budo

Dani AI

Generated

The approach in 's first post (a JS prompt with the secret in the page) is fundamentally unsafe: anything checked or stored in client-side script can be seen or bypassed. is correct to point toward browser-managed masking for entry, and is right to suggest hashing as an improvement — but those fixes only address parts of the problem.

Authentication and secrecy belong on the server. Do not rely on client-side checks or on shipping a static hash/secret in page code: an attacker can read source, copy a hash and replay it, or remove the check entirely. Use TLS for transport, submit credentials to a server endpoint, verify them there, and issue a short-lived session token. Store passwords with a modern, slow KDF (Argon2 or bcrypt) and a per-user salt; follow OWASP guidance on password storage for details and parameters (OWASP Password Storage Cheat Sheet).

For UI/UX: prefer a labeled form field handled by the browser (this gives masking, keyboard behavior and password-manager support). Offer an optional, accessible "show password" control so people can confirm input, and set appropriate autocomplete hints (current-password/new-password) so password managers work. Also avoid exposing passwords in logs, URLs, or error messages and keep client-side code free of any secret values.

Quick checklist

  • Replace prompt-based gating with a proper login form over HTTPS.
  • Authenticate on the server; store salted, slow hashes.
  • Support password managers and an accessible show/hide toggle.
  • Do not embed secrets or static hashes in client code.

Recommended Answers

All 5 Replies

Member Avatar for peter_budo

You need to provide proper type for input field like

<input type"password" />

plus any other parameters you need like length, maximum characters, name associated etc.

Edited by peter_budo because: n/a
Member Avatar for almostbob

'view source' and everyone has your password even if you fix the input box as type="password" elsewhere on this site,
I know not where i was browsing
there was another discussion thread that hashed the password, and sent the hashed value as password, and compared the hash of the entered password to the hash value, its harder to cheat

Edited by almostbob because: n/a
Member Avatar for peter_budo

I'm aware of it, but obviously OP is just beginner...

Member Avatar for almostbob

so am I :)
guess the answer was not appropriate to the skillset :(
the other thread was pretty simple to follow, and gave code samples tho

Edited by almostbob because: n/a
Member Avatar for peter_budo

so am I :)
guess the answer was not appropriate to the skillset :(
the other thread was pretty simple to follow, and gave code samples tho

We just have to wait and see what bibbleonline is up-to

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.