From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <asmadeus@notk.org>
Received-SPF: Permerror (mailfrom) identity=mailfrom;
 client-ip=2001:41d0:1:7a93::1; helo=nautica.notk.org;
 envelope-from=asmadeus@notk.org; receiver=<UNKNOWN> 
X-Greylist: delayed 56667 seconds by postgrey-1.37 at
 hurricane.the-brannons.com; Sat, 06 Jan 2018 04:17:13 PST
Received: from nautica.notk.org (ipv6.notk.org [IPv6:2001:41d0:1:7a93::1])
 by hurricane.the-brannons.com (Postfix) with ESMTPS id C6D257A586
 for <edbrowse-dev@lists.the-brannons.com>;
 Sat,  6 Jan 2018 04:17:12 -0800 (PST)
Received: by nautica.notk.org (Postfix, from userid 1001)
 id 0978BC009; Sat,  6 Jan 2018 13:20:17 +0100 (CET)
Date: Sat, 6 Jan 2018 13:20:02 +0100
From: Dominique Martinet <asmadeus@codewreck.org>
To: Chuck Hallenbeck <chuckhallenbeck@gmail.com>
Cc: Edbrowse Development <edbrowse-dev@lists.the-brannons.com>
Message-ID: <20180106122001.GA15436@nautica>
References: <alpine.DEB.2.21.1801051434001.5756@debian.pulsar.com>
 <20180105203532.GA30696@nautica>
 <alpine.DEB.2.21.1801060711290.9659@debian.pulsar.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <alpine.DEB.2.21.1801060711290.9659@debian.pulsar.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [Edbrowse-dev] Signing into my Amazon account
X-BeenThere: edbrowse-dev@lists.the-brannons.com
X-Mailman-Version: 2.1.24
Precedence: list
List-Id: Edbrowse Development List <edbrowse-dev.lists.the-brannons.com>
List-Unsubscribe: <http://lists.the-brannons.com/mailman/options/edbrowse-dev>, 
 <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=unsubscribe>
List-Archive: <http://lists.the-brannons.com/mailman/private/edbrowse-dev/>
List-Post: <mailto:edbrowse-dev@lists.the-brannons.com>
List-Help: <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=help>
List-Subscribe: <http://lists.the-brannons.com/mailman/listinfo/edbrowse-dev>, 
 <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=subscribe>
X-List-Received-Date: Sat, 06 Jan 2018 12:17:14 -0000

Hi Chuck,

Chuck Hallenbeck wrote on Sat, Jan 06, 2018:
> The file containing the failed signin is only about 3K, and can be
> fount here:
> 
> www.panix.com/~chuxroom/signing-in.txt

I'm not going to be very helpful regarding the js errors themselves, but
if your password is six numbers followed by two letters I'd advise you
to change reasonably quickly as it was written in play text lower in the
logs.
The password is sent in plain-text in a post value that is printed at
db3 later on.


We can reproduce the js problem, although it's actually the two errors
you get while loading the sign in page (so before what you posted) that
matter since that's the time js will manipulate the form values before
posting.
I'm not sure I'll be of much help but I'll try to look at it, even if
the code is obfuscated it should still run in duktape...

-- 
Dominique