getting around break frames code with cURL?

icydash

Hey guys. So i'm trying to make a remote login script for gmail / hotmail / myspace / facebook, etc...

The idea is that users should be able to type in their user name and password, select which site they want to log in to, and hit "login". The code should log them in and allow them to browse their accounts as they normally would, all while being kept at my site with my banner at the top of the page. I seem to run into problems with remote logging into gmail because it has a "redirect" feature when logging in ...same goes for hotmail ... and also a bunch of the sites have break frames code, so i cant just use an iframe to display the page with my banner at the top once you're logged in...so i was thinking of maybe using some kind of proxy based approach, or cURL?

does anyone have any idea how to do something like this??

Thanks!!

Zac

dagon

That breaches the terms of all those sites. So don't.

icydash

I actually work for a company that has recently gotten permission to bypass the break frames code "if we can do it" for both of those sites. We're going to each site, one by one, and requesting permission to do remote logins.

dagon

I would bet my hat your lying.

CoderDan

heh sounds like, assuming they did say that, they're letting you test their security for them for free 🙂

Anyways, an introduction what you are looking for is here.

icydash

Please see http://openid.net/

They are doing the same thing we're doing with a little bit of a twist. None-the-less, they are going company by company and asking for permission.

As long as they don't have to change their code, it doesn't hamper their security, and they're going to get some money out of the deal, what do they care if we do remote logins?

icydash

Thanks coderdan, but i've already looked through all that. Hotmail and gmail implement a redirect as part of their login and i havnt seen anything that handles that well.

bradgrafelman

icydash;10916047 wrote:
Please see http://openid.net/

They are doing the same thing we're doing with a little bit of a twist. None-the-less, they are going company by company and asking for permission.

A bit? That looks more like they're allowing remote sites to interface with their services; you're essentially doing the opposite.

I also didn't see any site listed in cooperation that I'd heard of, just a bunch of blogs, message boards, etc.

icydash;10916047 wrote:
As long as they don't have to change their code, it doesn't hamper their security, and they're going to get some money out of the deal, what do they care if we do remote logins?

They don't care; that's why software/companies with that type of an agreement have access to API's to do this sort of thing. The apps on Facebook, for example, most likely don't scrape your profile page for data but rather utilize Facebook's API for developers.

CoderDan

icydash;10916048 wrote:
Thanks coderdan, but i've already looked through all that. Hotmail and gmail implement a redirect as part of their login and i havnt seen anything that handles that well.

so telling curl to follow redirects, or reading the response headers and then following them yourself, while maintaining cookies, that's not the solution you need?
I'm not sure where your problem is I guess.

icydash

I also didn't see any site listed in cooperation that I'd heard of, just a bunch of blogs, message boards, etc.

Please see http://openid.net/get/ ... I think you'll know some of those sites.

But I'm not here to argue about this any longer, I'd appreciate strictly coding advice, not legal advice, if possible. We'll let the proper authorities deal with that.

so telling curl to follow redirects, or reading the response headers and then following them yourself, while maintaining cookies, that's not the solution you need?
I'm not sure where your problem is I guess.

Oh for some reason i didn't see that you could follow redirects. Does that occur in the ebay example on the page you sent me before? for some reason i couldn't get that to work; maybe i was just doing it wrong.

dagon

icydash;10916030 wrote:
Hey guys. So i'm trying to make a remote login script for gmail / hotmail / myspace / facebook, etc...

all while being kept at my site with my banner at the top of the page.

http://www.google.com/mail/help/program_policies.html
Prohibited Actions:
Reformat or frame any portion of the web pages that are part of the Gmail Service

http://pages.ebay.com/help/policies/everyone-ebayipuse.html

“Framing the eBay Site”

You seriously need to stop asking for support for an illegal activity on this forum.

icydash

http://www.google.com/mail/help/program_policies.html
Prohibited Actions:
Reformat or frame any portion of the web pages that are part of the Gmail Service

http://pages.ebay.com/help/policies/...ebayipuse.html

“Framing the eBay Site”

You seriously need to stop asking for support for an illegal activity on this forum.

(1) We arn't even talking about ebay...that site never has been suggested in this post.

(2) we already discussed this in length over the course of the last few posts. My company has permission. If you chose not to believe that, fine. But let the rest of us worry about that on our own and stop harassing us while we're trying to be productive and get coding done.