[WEB4LIB] Hex codes

[Thomas Dowling]

----- Original Message -----
From: Margaret Gross <mgross at CAM.ORG>
To: Multiple recipients of list <web4lib at webjunction.org>
Sent: Thursday, April 01, 1999 12:15 AM
Subject: [WEB4LIB] Hex codes


> Hi folks,
>
> I am looking to mask id & password showing in the url for some external
> links on our intranet. I was thinking of substituting the corresponding
> hex code for each element in the password. a) do you think this will
> work, and b) can anyone point me to a conversion chart.
> I have searched and thus come up only with colour hex charts.
> thank you kindly
> Margaret
> --


b) I can't remember seeing an ASCII table that doesn't include Hex values,
but you can't get much more authoritative than
<URL:http://charts.unicode.org/Unicode.charts/normal/Unicode.html>.
Hex-encoded characters in URLs will use only the last two hex digits.

a) No.  Anyone with enough gumption to steal your passwords from the URLs
will have enough gumption to unescape the hex codes.  You can convert hex
to decimal with any calculator or in your head, and a quick-witted Windows
user can convert decimal to ASCII anywhere Windows lets you enter text.

Beyond the security aspects, you also can't guarantee that the server will
unescape hex codes if it doesn't expect to see them, so it's possible the
encoded URLs won't even work.

Thomas Dowling
OhioLINK - Ohio Library and Information Network
tdowling at ohiolink.edu