Automatic Yahoo!mail or Gmail login by Javascript

[Stanley]

Hi,

I'd like to write a HTML page which can help me directly log in my
Yahoo!mail or Gmail account without typing user name and password.
Basically, I want to set up a link, click it and pop up the Yahoo/Gmail
page.

What technology is most appropriate for this kind of work?

My current solution is not so satisfying: I download Yahoo!Mail page
and save it to local file; then using Javascript to load that file and
set up user name, password, submit it to Yahoo.

This works with Yahoo, but not Gmail. I haven't got time to investigate
why.

The thing I hate about this solution is: for every email provider, I
need to download their page and write corresponding page to
access/modify it.

Is there any better solution?

Your suggestion is highly appreciated!

Stan

 

[kaeli]

I'd like to write a HTML page which can help me directly log in my
Yahoo!mail or Gmail account without typing user name and password.
Basically, I want to set up a link, click it and pop up the Yahoo/Gmail
page.

What technology is most appropriate for this kind of work?

POP3.

This works with Yahoo, but not Gmail. I haven't got time to investigate
why.

Google checks the referrer.
Set it (to google) and you're good to go. Probably. I don't have Gmail, but
this was an issue for Google Search for one of my apps.
Not very portable, though, as far as solutions go.

The thing I hate about this solution is: for every email provider, I
need to download their page and write corresponding page to
access/modify it.

Is there any better solution?

Not that I can see. They're all going to have different field names more than
likely and they will have different referrers (if they check), so any code
would have to use different names and values for the POST request anyway. And
some may verify other headers that you would have to duplicate. This was an
issue when I tried to putz around with MySpace.com.

You could play with Java for this (or any language that supports sending HTTP
POST requests), but it's probably more of a pain than it's worth.

--
--
~kaeli~
Profanity: the single language in which all programmers are
expert.
http://www.ipwebdesign.net/wildAtHeart
http://www.ipwebdesign.net/kaelisSpace

 

[Ivo]

"Stanley" asks

I'd like to write a HTML page which can help me directly log in my
Yahoo!mail or Gmail account without typing user name and password.
Basically, I want to set up a link, click it and pop up the Yahoo/Gmail
page.

What technology is most appropriate for this kind of work?

I have a bookmarklet to auto-fill some forms on pages I visit regularly
enough. something like the following, all on one line and in less than 508
characters if you use IE:

javascript:function(){
var a=document.forms[0].elements,i=a.length,j,k;
while(i--){
j=a, k=j.name;
if(location.host==='mail.yahoo.com'){
if(k==='login'){ j.value='myname'; }
else if(k==='passwd'){ j.value='mypassword'; }
}
else if(location.host==='gmail.google.com'){
if(k==='Email'){ j.value='myname'; }
else if(k==='Passwd'){ j.value='mypassword'; }
}
}
document.forms[0].submit();
}

Consider who can access the Favorites folder and read its contents, and
decide if it's safe with that in mind. Perhaps patience and the continuous
effort of repeated typings is the most appropriate after all.

 

[Lasse Reichstein Nielsen]

I have a bookmarklet to auto-fill some forms on pages I visit regularly
enough. something like the following, all on one line and in less than 508
characters if you use IE:

Cute idea. To make it as short as possible, it could be rewritten something
like:
---
javascriptfunction(){
var k={
'mail.yahoo.com': [0,{login:'myname',passwd:'mypass'}],
'gmail.google.com':[0,{Email:'myname',passwd:'mypass'}]
}[location.host],
f=document.forms[k[0]],e=f.elements,i=e.length,v;
while(i--)if(v=k[1][e])e.value=v;
f.submit();
})();
---
Remember to put on one line before using. It will give a Javascript
error if it is used on an incorrect page, but who cares When
spaces and line breaks are removed, it's ~260 bytes.

The format of the data literal is:
{ <hostname> : [ <form index>, { <fieldname>:<value> , ... } ] ,
... }
It allows for pages where the login form is not the first one, and
any amount of fields that need to be filled.

If passwords or usernames are really repeated, space can be saved by
assigning to a variable first, and reusing it in the data object.

(Yes, I think optimizing for space is *fun*
/L

 

[Ivo]

"Lasse Reichstein Nielsen" wrote

Cute idea. To make it as short as possible, it could be rewritten
<snip>
f.submit();
})();
(Yes, I think optimizing for space is *fun*

Ah, fun! we should hear that more! It looks quite optimum indeed. WOuld you
perhaps also know a funny and short solution to prevent submission if k
didn't match, ie. the bookmarklet was activated on an unsuspecting page and
I don't want to submit any forms I haven't even seen first. I speak from
experience here, I have missed that feature from my bookmarklet several
times now.
Ch.

 

[Lasse Reichstein Nielsen]

Ah, fun! we should hear that more! It looks quite optimum indeed. WOuld you
perhaps also know a funny and short solution to prevent submission if k
didn't match, ie. the bookmarklet was activated on an unsuspecting page and
I don't want to submit any forms I haven't even seen first.

Hmm. That would mean making sure that the correctly named form
controls did exist. Should be possible. hmm.... (and a little more
optimizing

---
javascriptfunction(k,f,n){
f=document.forms[k[0]];
for(n in k[1])f.elements[n].value=k[1][n];
f.submit();
})({
'mail.yahoo.com': [0,{login:'myname',passwd:'mypass'}],
'gmail.google.com':[0,{Email:'myname',passwd:'mypass'}]
}[location.host]);
---

Again, no error checking. If the form lacks a required field,
it becomes "undefined.value=k[n]" ... immediate exit

An error checking version (i.e., stopping but not throwing an error)
would be a little longer:
---
javascriptfunction(k,f,e,n){
if(k&&(f=document.forms[k[0]])){
for(n in k[1])if(e=f.elements[n])e.value=k[1][n];else return;
f.submit();
}})({
'mail.yahoo.com': [0,{login:'myname',passwd:'mypass'}],
'gmail.google.com':[0,{Email:'myname',passwd:'mypass'}]
}[location.host]);

 

[Stanley]

Forgive my ignorance: how do you use bookmarklet?

1. Store it in Favorite
2. Go to page like: mail.yahoo.com
3. Click that bookmarklet link

I am a pretty lazy one I'd prefer one-click to destination.

Is my understanding right?

 

[Csaba Gabor]

There is another approach, besides the nice Ivo/Lasse thread,
that has worked for me. Use vbscript (IE write a LoginToGmail.vbs
script) to bring up a fresh (or latch onto a specific) copy of IE
on Windows. Then direct IE to the login page. Then, you can,
through VBScript's access to the DOM, fill out the relevant
login and password entries and get directly to the page you want.
Just to emphasize, it is the external VBScript that is doing this,
since it has the authority to access the DOM of the top level pages.

The advantage that this method has over the javascript
version is that you can go through a sequence of multiple
pages whereas the javascript version gets you at most
one page before you wind up in a different domain.

Csaba Gabor from Vienna

 

[Lasse Reichstein Nielsen]

Forgive my ignorance: how do you use bookmarklet?

1. Store it in Favorite
2. Go to page like: mail.yahoo.com
3. Click that bookmarklet link
Yep.

I am a pretty lazy one I'd prefer one-click to destination.

That's harder because of browsers' security settings not allowing
cross-domain scripting. The click that loads the page happens on
a page from another domain (pretty likely), and the same code
is not allowed to affect the new page.


You could probably do something with Opera 8's user.js, where you
pre-fill-out forms as soon as they are loaded (but then again, you can
just use a form-filler built into, or available as plugin to, most
browsers)

/L

 

[Richard Cornford]

There is another approach, besides the nice Ivo/Lasse
thread, that has worked for me. Use vbscript (IE write
a LoginToGmail.vbs script) to bring up a fresh (or latch
onto a specific) copy of IE on Windows. ...

<snip>

WSH can open the IE browser component, and then freely script it in
JScript or VBScript (and some others) without cross-domain security
restricitons.

Incidentally, Csaba, if you continue to top-post here you are unlikely
to get as much help here yourself as you have in the past.

Richard.

 

[Stanley]

That's a method I'd like to try out. Thanks for suggestion, Csaba!

 

[Csaba Gabor]

Csaba Gabor wrote:

WSH can open the IE browser component, and then freely script it in
JScript or VBScript (and some others) without cross-domain security
restricitons.

This isn't quite true, is it? If I bring up an instance of IE (via
WSH/VBScript) and go to a page which has an embedded I/Frame with a
different domain, then I can't gain access (from the calling .wsh or
..vbs file - at least this was my experience with VBScript on Win 2K
Pro / IE 5.5 two years ago) to that embedded domain's DOM using
traditional script methods . The original version of IE 5.5 did
allow the containing page to access the contained DOM (which is why I
never patched that machine!), but that was a security flaw which was
patched.

Incidentally, Csaba, if you continue to top-post here you are unlikely
to get as much help here yourself as you have in the past.

I would regret not having responses from you, Richard, since I consider
you one of the most reasoned, in depth persons in the groups I've been
in. But my actions are considered. If I am soliciting responses or
responding to someone who is responding to me, then I follow current
convention; or rather, I tend to reply with the convention of the responder
(usually bottom posting for single response, or interspersed for multiple
responses).

However, I believe this convention of bottom posting rests on flawed
principles, and that it will eventually be retired. So if I am a
primary respondent, offering advice or a suggestion, I will respond
in the manner of my choosing. The manner of my choosing is usually
dictated by what is most efficient for me, not only in responding
but for future reference (google is my filing cabinet). Since
bottom posting, as a general rule, is not nearly as efficient as top
posting * for me * I may top post for a single response or intersperse
for multiple responses). Increasingly, most of the time when I top
post, I will make a summary of what I am responding to (ie. I
usually respond with complete sentences for the sake of efficiency
and for all).

Csaba Gabor from Vienna

 

[Richard Cornford]

Richard Cornford wrote:

However, I believe this convention of bottom posting rests
on flawed principles, and that it will eventually be retired.

The convention is not bottom posting, it is interleaved posting with
responses under quoted sections that are being responded to and provide
a context for those response. And it isn't going to die out because it
is the form of communication best suited to the medium, which
considerate newcomers tend to rapidly realise.

... , I will respond in the manner of my choosing.
The manner of my choosing is usually
dictated by what is most efficient for me, ...
* for me * I ... I ... I ... I ... I ...

<snip>

In a medium that is intrinsically one-to-many communication personal
preference is not necessarily a good guide to behaviour.

But suite yourself, not lifting a finger to provide you with any
assistance requires no effort on my part, but you might be a bit
cautious about encouraging others to shoot themselves in the foot as
well.

Richard.