You really think that can stop me? Another example of secuity through obscurity which is futile.

So the last few nights I have been doing a bit of research on AJAX UX, where I came across a site that I found interesting. I went to "View Source" to see how they were doing something and the darn thing wouldn't let me, with some progammer's brain drain of a secure method to prevent that action. This annoyed me a bit and I decided to figure out what was going on.

This sort of protection shows why security by obscurity is a poor security safeguard. It takes very little to bypass it. Especially since this is code on the client side being rendered. I could of course simply sniff the traffic, but there is a simpler solution which I figured out pretty quick.

My solution? Inject a bit of Javascript into the session and barf out the innerHTML in a popup window. :-)

So the next time you come across somebodies idea of copy protection for web content, try typing this in your URL bar and hit enter:


javascript:window.open( '', '', '' ).document.write( '<textarea cols=80 rows=40>' + document.body.parentNode.innerHTML + '</textarea>' );


Blows by such idiotic protection schemes that gives a false sense of security to the content owner.

Normally, I wouldn't show this sort of thing publicly. I contacted the original site webmaster to explain this attack vector to his code, only to receive a nasty email in poor taste where he referred to me as a "two-bit wannabe hacker that doesn't know what [I am] talking about" (his words... not mine). It's this kind of attitude of many web developers that has me up in arms, and has me feeling its appropriate to show the attack.