Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I tried to login to gmail using this but it didnt't work.I just saw this before opening gmail Boxes

Is there something to automate such a thing

EDIT:

I tried this also but din't work

EDIT:

This website shows good instructions to proceed but after running as told its not opening my browser otherwise its fine according to the instructions mentioned.

share|improve this question
1  
This works for ftp auth, but there is ftp:// and not http://. Or maybe this is for websites there is some simple form of http auth. Gmail not the one who does that. – excanoe Jun 12 '11 at 7:01
Why would you send your password in clear text? – ngen Jun 12 '11 at 7:04
1  
ngen, it hashes the password, actually. However, it's still vulnerable to replay attacks. – Nick ODell Jun 12 '11 at 7:06
I want to have somthing like this to login to websites without typing the password OR wothout using the feature of the browser "save password" – munish Jun 12 '11 at 7:07
Then you'll need to build something custom on a per-website basis, this will usually involve constructing a form, and you'll be out of luck if they have protection against CSRF. – Quentin Jun 12 '11 at 7:33

migrated from stackoverflow.com Jun 12 '11 at 7:37

3 Answers

up vote 4 down vote

In an http url, it's for HTTP authentication. HTTP authentication is rarely used. It's rarely used because web applications usually contain their own users list in a database instead of having the http server manage authentication.

The comments about its insecurity are somewhat misleading, because when done over SSL, it's exactly as secure as POST based logins. An MD5 hashed password challenge is also possible which you can read about here: http://en.wikipedia.org/wiki/Digest_access_authentication

share|improve this answer
up vote 0 down vote

I believe it is another way to specify basic authentication credentials using the URL. It isn't secure so most sites don't use it and I don't recommend it. I believe the browser converts it to the header, but anyone sniffing your communication could use your account by simply sending the same header.

http://en.wikipedia.org/wiki/Basic_access_authentication

share|improve this answer
2  
Almost correct. It's as insecure as the pop-up dialogue, the browser sends them both in exactly the same way. It exists so that scripts and command-line tools can access sites that require authentication. It's part of the official URL spec: w3.org/Addressing/URL/url-spec.txt – Chris Browne Jun 12 '11 at 7:13
I tried this also but din't work – munish Jun 12 '11 at 7:19
up vote 0 down vote

Is there something to automate such a thing

Depending on what you're trying to do, using Selenium might do the job (Selenium IDE has a Firefox plugin that allows you to record and playback actions on a website). If you only don't like to type passwords, Firefox has password saving built-in. If you want to automate it from a script, then you might need to reverse engineer gmails' authentication form and do HTTP Request yourself; alternatively you can try python's mechanize or perl's mechanize, which allows python/perl scripts to browse websites, fill forms, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.