Just found a site that uses GWT!

[TheB...@gmail.com]

http://play.typeracer.com/

typing game. it uses gwt.

[TheB...@gmail.com]

I realized gwt makes exploting javascript complied by gwt is a lot
harder.

in sites that is written with normal javascript it is easy to exploit
when it is javascript games.

for gwt what makes it hard to exploit is the source code of the js is
not easy to read at all.

for example sudukocraving i could make a javascript script that can
solve the puzzle and inject it into the website using
javascript:void()

for the typeracer site I figure out how to get the input box however
when I fill in the word I could not figure out the function that looks
at key press event and do the function after.

For sites that was written in js normally it would be easy to read and
I could just call checkWord() or something.

Also for sites that uses js to kind of make html not readable those
are easy to bypass just by calling the uncompressed output and
alerting it.


So gwt makes javascript hacking a lot harder :)

[paulss...@gmail.com]

If the js is written by someone else using GWT and is therefore
obfuscated then good luck!

But if you're writing your own GWT app and you know you're going to
want to hook into it using javascript for whatever reason... not sure
why you would... but you should use GWT's JSNI which is a way of
getting the GWT compiler to output some handwritten js code. This is
handy for primitive implemenations for things like js to flash
bridges, etc (although I'm working on a GWT wrapper for the entire
actionscript language if anyone is interested?)

[Joseph N. Hall]

TypeRacer was hacked a number of times (1000 words per minute?) but
the author has fixed most of those opportunities.

It's a pretty nifty application.

Still, you always have the option to mess with the RPC.

[Axel Kittenberger]

Any client is hackable that is not a 2D sequential images displayer
from the server...

[Alex Lam S.L.]

Doesn't seem to work under IE8...

Alex.