Hacker News Reader

Comment by ebtalley | Hacker News Reader

question, how did you grab the session and display tasks without authenticating through OAuth or whatever method google provides? Granted I'm logged into gmail but I'm somewhat goosed since it seems your third party domain can pull private data from my account without my explicit permission?

View on HN

Good question. It's actually just an illusion. My page simply instructs your computer to connect to Google's servers, and then "wraps" the responses from Google at the page level into frames. I literally cannot see anything at all that you send to Google or receive from Google. In fact, this entire app is 100% client-side, so it never communicates with my server except to download the initial code (ok, fine, and favicon).

There was an old trick years ago where mischievous webmasters would "wrap" a file:// URL in their web page to make it look like their page had access to all the files on your computer. Again, it's just a wrapper. No data is transmitted to or from the server about what's in the wrapper.

It's a handful of iframes going here: https://mail.google.com/tasks/ig , nothing more.

I'll stick to https://mail.google.com/tasks/canvas though this is quite nice. I wish it could remember the lists I had visible, but I realize why it can't :)

To the maker: nice idea! It makes me ponder over what other sites this could be done to... though this is a particularly perfect fit!

Thanks. And yeah, I really wish it could remember the lists. I'm hoping that someone will know an undocumented parameter we can pass to http://mail.google.com/tasks/ig to select a list. Anyone?

I snooped around a bit and it seems that you can do it by POSTing a JSON parameter to that URL, although I'm not sure if it includes a nonce.

I just figured it out! Now, in Chrome and FF4 it remembers the lists you select. I'm really excited about this...enjoy! :)

Very nice, that makes it a lot more useful :) I may even switch from Canvas view. Hopefully others see this!

Mind if I ask how? I see the URLs are list-specific now, but I don't know how you set it up to be so.

Hey Groxx how did you find about the /canvas link? I could find no reference on Google that would have direct me to it in the first place! Very curious how you knew about it. Thanks for it btw as I never knew it existed.

http://www.google.com/support/websearch/bin/answer.py?answer...

It is a part of tasks for iGoogle.

I found out about it via the Better Google Tasks Chrome extension. Probably never would've seen it otherwise.

Reply on news.ycombinator.com