On Fri, 2 Apr 2004, Ivan Daniluk wrote:
Hi Jorge.
Hi!
Maybe, we should open popup dialogue and ask user for login/password?
The login may be specified in dillorc, and the password asked in a popup dialog (whenever there's a login in dillorc :).
This adds the burden of entering the password, but keeps things a bit more private. I've implement this burden :), but stuck in a problem and need advice and/or suggestion from you. First, look to the attached current patch for stable dillo 0.8.0 release.
Oh, I haven't yet. Anyway, here's the answer.
Main problem for me is the way to stopping the query, waiting until password will be entered or canceled, and resuming it. When we call a_Interface_proxy_passwd_dialog(), the dialog window pops up, and query goes forward, without being formed with proxy password. So, I see two ways: 1) to stop the query forming(in Http_get() function) and wait, while proxy_passwd_dialog_window will be destroyed. 2) to abort the query, and recall it when password will be entered.
I'm a newbie in gtk programming, and can't figure out how to graceful open dialog window and wait until it'll be closed. If it's possible, than imho it's the best way. About second choice.. There are complexity for me in a_Http_ccc stuff. Sure, I'll win this problem, but it will take more time. And really want to hear your thoughts about it.
Use the third alternative! :-) AFAIS the simplest way to to it is to ask for the proxy password when dillo starts, that is, before any query is made, probably after the splash screen is displayed. That way, things would reach the same simplicity as in the first patch!
One more question around it. Password dialog window is activating in case if there is option "http_proxyuser" in config, but not when http query gets "Cache Access Denied" error. Is this way ok?
AFAIU, yes. The proxy login/password pair is one thing, and HTTP's simple authentication mechanism (section 11) is another. It may happen that you reach a realm/password protected page through a login/password authenticated proxy. Now, if after this patch, you want to keep on working on basic authentication, be sure to contact Madis (AFAIR he once worked on it), and I can make the CCC bindings to stop/resume/forward the querying process.
And, the last note on patch. It's about following lines in IO/http.c: + if ( strchr(prefs.http_proxyuser, ':') ) + { + DEBUG_MSG(5, "Storing proxy password in dillorc is insecure!\n"); + ask_proxy_passwd = FALSE; + HTTP_Proxy_Auth_base64 = a_Misc_encode_base64(prefs.http_proxyuser); + } It allows user to store in config file not only proxy user name, but pair "user:password" as well. I've done it's mainly for convenience, but of cource we can remove it from patch.
Hmmm, this is one I'm not yet sure of. On one hand, it is very handy not to have to enter the password every time, and on the other, stealing the proxy's password becomes quite simple (for instance, a bathroom break and it's gone! ;). [minutes thinking...] It's not a thing I'd recommend. Now, as Dillo project is explicitly concerned about security, it can't do otherwise. Perhaps you may leave that portion of code commented out, so the responsibility is left to the one that decides to enable it. I'd like to hear comments about this. Specially from sysadmins.
Your suggestion for me are welcome.
Thanks. Cheers Jorge.-