Schinckel.net

A nice post from Joe Maller about web-focused workflow, using Git.

A web-focused Git workflow After months of looking, struggling through Git-SVN glitches and letting things roll around in my head, I’ve finally arrived at a web-focused Git workflow that’s simple, flexible and easy to use.

From A web-focused Git workflow

I’m thinking about doing something similar with Mercurial, since that’s my DVCS of choice. Most of the concepts are directly comparable, but the commands are a bit different. When I’m done, I’ll write it up.

(This is more a note to self, than anything else!)

(Note This is an essay I wrote for a subject at Uni. It doesn’t really draw any conclusions, because I don’t think there is a solution to the problem of passwords, just yet!)

OpenID, Biometrics and Passwords in the age of Internet Everywhere

“The best passwords are random sequences of symbols…”

The first computer systems had no need for security. Physical security was enough of a barrier. Indeed, the only truly secure systems today are not connected to the rest of the world, and have physical security measures in place to prevent access. Even the early generations of shared systems didn’t have passwords - it was just accepted that you wouldn’t look at data you weren’t supposed to, and the idea you might damage a system deliberately, well…

Obviously, those utopian days are past. Identity theft is a serious issue, and so is data theft. Passwords no longer protect just email, and being able to pretend you are someone you aren’t, but now passwords are used to get access to our finances. It takes only seconds for a disclosed banking password to result in all of a victim’s accounts being cleaned out.

Passwords are an obvious method of only allowing authorised users to access information or a system. By tying a username and password to a user’s “identity”, it suddenly becomes possible to allow access from anywhere in the world, safe in the knowledge that the access will not be misused, or if it is there will be a record of who accessed which data when.

But passwords are seriously flawed. To begin with, once a user’s password is compromised, the intruder, for all intents and purposes, is that person. Putting this fact aside, passwords are still in much greater use than two-factor authentication methods, or any others available. Why? Simply because it is easy to store passwords. It is easy to enter them, with no special hardware required. And people are used to the idea of a password.

Another serious issue with passwords is that it is often very easy to guess a user’s password. A user may set their password to a pet or partner’s name, or a date that means something. Even if they choose a random dictionary word, it may be possible to use a brute-force method of guessing that password that can result in entry being obtained in a very short period of time. A further issue is that a user may use the same password (and perhaps even the same username) across a series of locations. An intruder need only discover the password on one site, and instantly they have access to several aspects of the victim’s identity. All of a sudden, it becomes hard to prove that the attacker is an attacker, and not the person who’s identity they have stolen.

So, the first way to “fix” passwords is to have a password that is made of totally random characters. Ideally, these characters should encompass both lower and upper case, numbers and symbols. For a password to be easily entered, the characters should all be easily typed in using a keyboard. Non-printable characters may make a good password from the security aspect, but they aren’t that useful from a user’s perspective.

But having random characters also means that the password is harder to memorise. Personally, I find that once a password has been typed in enough times it becomes muscle memory, rather than memorising the actual password, but it needs to be memorable to the extend that the muscle memory can be created. Several schemes have been used to make psuedo-words that are pronounceable, yet not dictionary words. Some examples of these can be seen below.

• DuenTr31
• eNtaNs74
• fablis86
• LolvAR47
• cArbEL30
• ulawle83

As can be seen, these words can all be pronounced. It would not take too much mental effort to memorise these words in order to use them for a password. Compare these to the following unpronounceable, yet more secure passwords:

• ZAy#km8*
• gqVaw7#
• gXTrUttf
• rku7#xe
• h9N#Ng
• cjG-_56

So, that’s the first problem solved. Create a different, secure password for each system or account you need to access. Of course, in reality, things are not quite so cut and dried. A system I access every day will quickly store its password in my muscle memory, but one I only access a handful of times per year, or worse yet, a site I hope I never need to access again, but may several years into the future? How can a regular person be supposed to remember all of these usernames and passwords?

And this problem is just compounded when sites and systems implement a “password freshness” system, where a password must be changed after a certain amount of time. This means that should an attacker obtain a list of encrypted passwords (since we don’t store passwords in plain text), then hopefully the users will have all changed their passwords by the time they brute-force the passwords. But it still just creates a huge cognitive load upon the user to generate and remember many, many passwords.

The solution I use, as a security conscious individual is to generate passwords as needed, and store them in a “Keychain”, which some Mac OS X includes as part of the core operating system. Applications can apply for access to a particular keychain username/password combination, which the user can then approve on a one-off basis, or every time the program requires the credentials. This works out as a highly secure, yet convenient method of protecting my identity. Besides, most of the sites I access are not on their own that “important”, other than my banking and email sites. To me, the biggest advantage is that the passwords I use at each site are different, and one of these being discovered does not make the remainder of my passwords compromised.

But it is not flawless. It works for me, because I store all of the passwords on virtually the only machine I use, my laptop. If an attacker was able to compromise my laptop, then they would (possible) obtain access to all of my passwords, as well as all of the other data on there. Encryption and personal laptop security can ameliorate this threat somewhat, but the danger still exists.

The other issue is that without the laptop, or at the very least access to the Keychain from some outside source, I do not know the passwords to all of these systems and sites. With a broken machine, I am no longer a first-class member of the digital community. Instead I am limited to sites that I know the passwords for, which are few and far between.

As soon as passwords are implemented as an authorisation system, some method of allowing people who cannot remember their passwords is usually implemented next. This is increasingly becoming a less secure situation, as was recently demonstrated in the lead-up to the US Elections (2008). With the increasing amount of information available about most people “on the internet”, questions that are often used as password reminders are often answered by information that can be searched for easily. A high profile person like Sarah Palin has a huge amount of information about them on a variety of websites, and one enterprising malefactor discovered that all of the information required to answer all of the secret questions on her email account was available.

The main alternative to Secret Questions involves the use of a link to reset a password, often which is sent via email. Email itself is somewhat insecure, without other protection in place, and it assumes the user has a valid email address.

The main software-only alternative to a password is a token-based approach. If you have a particular file, then that “proves” you are the person who owns that file. Clearly, this has the same implications about theft of that file or token that a password does. However, it has some other interesting aspects that are worth discussing.

The software token based system owes a large part of its efficacy and security to the discovery of Public Key cryptography, and the fact that some mathematical operations are easy to do in one direction, but extremely difficult to reverse. An example of this is that it is easy to multiply a group of prime numbers, but significantly harder to factorise the result.

Public Key cryptography relies on the asymmetry of operations, and uses a pair of matched keys. One of these is the private key, which must never be shared with others. The other is the public key, which is freely available. Typically, PK cryptography has been used to allow for secure message transmission, where a user encrypts a message using the public key, and only the holder of the private key can decrypt it. Similarly, the holder of a private key can encrypt a message, and then another user can use the public key to decrypt it, “proving” the private key holder sent the message. This process is called signing. An analogous process to signing can be used by a pair of keys located on different machines to allow for a user to log in seamlessly, without the need of a password. This is often used in Unix based machines to have SSH passwordless login, but is not generally suitable for general user consumption!

The whole Public Key infrastructure effectively sits on a house of cards, effectively. I can generate a key-pair, very simply, and say that these keys were created by any person I choose. For instance, I could create keys that looked like they were created by Barack Obama, and if anyone used the public key, they would (a) think they had encrypted messages for Obama’s eyes only, and (b) think that messages coming from me had come from Obama.

Clearly, what is needed is some sort of a process for indicating that keys are actually created by who they look like they are created by. Thawte, amongst other Certification Authorities, have built big business on just this idea. People and companies must pay to create certificates (or keys) saying who they are, and in theory the only way to get a certificate is to prove in the real world that that is indeed who you are.

Another token-based approach is to use a physical token. Several financial institutions have implemented systems where an account holder has not only a password, but also a device that has a number generator tied to an oscillator, the algorithm of which is also held at the server end. The clocks are deemed to be in sync, and when a login request is generated, it must also include the current number. The login server will only accept a request if it includes both the user’s password and the valid number.

The token aspect of these systems is intriguing, but is limited in the same way of a password or software token. Someone needs only to steal the token and they are granted access, and these types of systems are also vulnerable to a “man-in-the-middle” type phishing attack. Including a password (so-called two-factor authentication) slightly improves the security. It means that instead of just being “something you know”, or “something you have”, all of a sudden the attacker must have both of these.

The final word regarding security includes the third something: “something you are”. Biometric measures of identity assurance take a personal attribute, such as a scan of the retina, a fingerprint or some other aspect of “person-ness”, and compare this to a stored value. Early biometric systems used voice recognition, but until quite recently they were restricted to installation at physical locations, due mainly to cost. Recent developments have resulted in fingerprint scanners on laptops, amongst other things.

Having a biometric scanning device in a physical location is very good for preventing physical access. Several issues start to arise when you take the scanning device and place it in an insecure location. The first is that it suddenly becomes possible to do things like playing back a recording of a voiceprint, or holding a high resolution photograph of a face up to a camera. Hollywood

has also shown us that latent prints left on a fingerprint scanner can be turned into a fake finger, to bypass that aspect of biometrics. Even stealing someone’s retina is apparently enough to trick the sensor.

But these don’t even come close to the real potential of bypassing the security. If the raw data is sent by the sensor to the authentication server, then that raw data could be spoofed by a malicious person. If the scanner does the authentication too, then a device could be created which just passes a message that authentication was successful.

Biometrics are still expensive, still somewhat error prone, and not all that satisfying. So where does that leave us?

Authentication is an important problem. Passwords are fine when we only have one or two. But they don’t work when we have many, or we take shortcuts and use insecure passwords.

But what if we “outsource” the authentication? Increasingly, many websites and web-applications are moving away from a password-based login, to one using OpenID. OpenID is an open system that allows for identity to be “proven” without having to store or remember a whole stack of different passwords. To quote the OpenID website: “For geeks, OpenID is an open, decentralized, free framework for user-centric digital identity.” It allows for technical users to “host” their own identity, and other users to use an OpenID provider to claim their identity, content and online persona.

OpenID is not a panacea. It still falls ill to the trust issue - I can have an OpenID and name it after anyone I want - but it does allow for me as an online citizen to say that each of these items of content were all created by the same person. At this stage OpenID seems limited to things like blogs and discussion boards, but at this stage, it seems unlikely to be secure enough to work as authentication for “real” systems such as banks.

Interestingly, the biggest feature of OpenID is also it’s biggest security risk: if your OpenID was compromised, then the attacker automatically gets access to all of the sites that use OpenID, without having to actually remember or enter the password! It’s like having used the same password in each case, only worse!

Passwords will stay with us, at least for the foreseeable future. The best we can do is hope that other Operating Systems will provide us with tools to help the user create and store multiple, secure passwords. A system to replace passwords will only work if users feel comfortable with it, and if it is more secure than passwords. At this stage, none of the potential solutions look like they check all of the boxes.

Bibliography

1. Attwood, Jeff (2008), Coding Horror: OpenID: Does The World Really Need Yet Another Username and Password?, http://www.codinghorror.com/blog/archives/001121.html [accessed on 14/11/2008].
2. Lange-Hegermann, Stefan (2007), SourceBricks Software - QuickPass, http://www.sourcebricks.com/page/quickpass.html?qpabout=true, [accessed on 11/11/2008].
3. Lucas, Ivan (2007), Password Recovery Speeds, http://www.lockdown.co.uk/?pg=combi&s=articles [accessed on 14/11/2008].
4. Luitjen, Erik, (2002), Password-less login with ssh, http://ariadne.mse.uiuc.edu/Cluster/ssh_log_through.html [accessed on 11/11/2008].
5. OpenID Foundation, (2008), OpenID » What is OpenID?, http://openid.net/what/, [accessed on 11/11/2008].
6. Schneier, Bruce (2006), Microsoft Anti-Phishing and Small Businesses, http://www.schneier.com/blog/archives/2006/12/microsoft_antip.html [accessed on 14/11/2008].
7. Schneier, Bruce (2006), Schneier on Security: Real-World Passwords, http://www.schneier.com/blog/archives/2006/12/realworld_passw.html [accessed on 14/11/2008].
8. Schneier, Bruce (2006), The Failure of Two-Factor Authentication, http://www.schneier.com/blog/archives/2005/03/the_failure_of.html [accessed on 14/11/2008].
9. Thawte, Inc (2008), thawte - buy SSL certificates from thawte, https://www.thawte.com/ssl-digital-certificates/buy-ssl-certificates/index.html?click=main-nav-buy [accessed on 14/11/2008].
10. Zetter, K, (2008) Palin E-Mail Hacker Says It Was Easy, http://blog.wired.com/27bstroke6/2008/09/palin-e-mail-ha.html, [accessed on 11/11/2008].

I had a big night on Saturday. But that’s irrelevant to the story.

The interesting thing about Saturday night is was that it was apparently the first use of the new SA Police drug sniffer dogs. And there were plenty of police about on Saturday night.

We first noticed them when we arrived in Hindley Street, which was probably about 10pm. Before we’d even made it to the second block, we’d seen a person being searched by three plain-clothes cops that really didn’t look at all police-like. We stood around and watched for a little while, before heading down the street.

At which stage a dog on a lead with an attached police person went past us, and then nabbed two more guys for drugs.

Eventually, we made it into “The Apothecary,” where we saw yet another person being searched on the glass just outside where we were sitting.

Apparently three people were charged with drug trafficking, I’d love to know how many were done for possession.

Vector Magic desktop edition is now available. It can convert bitmap images into vector images, with fairly impressive results. You can tweak the settings throughout, and it’s a useful tool if you need to do this sort of thing. Much easier than hand-tracing scans of logos and the like!

Here’s one I prepared earlier. I think I’ll tweak the right eye, but otherwise it looks pretty good. It’s much easier to make the background transparent if you don’t have to worry about anti-aliasing, too.

For reference, here is the original image, scaled to about the same size. Pixellated, a bit!

I have a Windows box on my desk at work now. ugh.

To make it bearable to use Visual Studio, with her three areas and a scroll mouse:

KatMouse

This makes it operate like OS X, where the controller that the mouse is over scrolls, rather than the active one.

If you instantly go “Yes, I know what you mean”, then you’ll need this.

You need two items of software, TortoiseSVN and Putty. Make sure you get the Putty that has all of the extra tools, you’ll need puttygen at the very least.

Once you have installed Putty, open up the main putty.exe program. The installer put a shortcut on my desktop, yours may not have:

In the window that appears, enter lofty.infoeng.flinders.edu.au into the Host Name box:

Then, enter lofty into the Saved Sessions box, and click Save. This will save you a little bit of typing later on.

Now, select the Data item from the left tree-view (you may need to expand Connection first). Enter your Flinders CSEM/InfoEng password into the indicated box.

Click back into the Session tab, and click Save again. Now click Open.

A new window will appear, which will ask you for your InfoEng password. You’ll need to enter it just this one time.

What we need to do is create a private/public key pair. One of these will live on lofty, the other on your local computer.

Before we do that, create the correct location to store this on lofty:

mkdir .ssh

Note that there is a dot before the ssh!

Now issue the command:

ssh-keygen -b 1024 -t rsa

Use the default location: ~/.ssh/id_rsa

Use an empty passphrase, and you’ll need to press enter twice. It then saves the file into this location, and creates a public key as well.

Enter the .ssh directory, and type in the following command. (Even if you already have keys in the file it copies them to, it will still be safe!):

cat id_rsa.pub >> authorized_keys

This copies the public key into the authorized_keys file, appending it to the file if it already exists.

We now need to get the private key onto your home machine. The easiest way is to type in:

cat id_rsa

and copy and paste the text into a new Text Document. Rename this to something sensible (id_rsa again is a good choice). Don’t ever let anyone else access this file, as if they do, they can get into your InfoEng account!

Now, run puttygen.exe. Click on Load, and select the file you just created in Notepad. You may need to turn on “All Files” in the file chooser. You’ll now need to save the private key. It’s a good idea to use the same filename, but with the ppk extension.

Now run another instance of putty.exe.

Click on the lofty Saved Session, and press Load. Then choose the SSH/Auth option, as shown.

Use the Browse… button to select your keyfile. (The one with a .ppk extension, not the one you created first).

Before you click Open, go back to the Session page and click Save again. Otherwise your selection of the keyfile will not be saved next time you try to connect (but it will work this time).

Finally, click Open to test the connection. You should log in without having to enter your password.

That’s all of the Putty stuff we need to do. You can’t uninstall it, and it’s worth keeping around in case you need to SSH into the Uni machines again. When you do, it’s almost the same as opening a Command Shell on the Solaris machines, so you can do most of your work from home.

If you haven’t, install TortoiseSVN now.

Go to the directory that you want to keep your local copy of the SVN repository in. Right-click and select SVN Checkout… from the menu.

The only things you’ll need to change are the URL, and possibly the last component of the Checkout directory. It’s currently called SVN, but you can call this last bit whatever you want.

Press OK. It will, in a fairly short amount of time, get all of the data.

The contents of the directory you checked out now have Badges, showing if they are up-to-date, Modified, or so on. I’ve created a Sandbox directory for you to play around in, but the good thing about SVN and other systems is that you can’t really break anything. Someone can always revert any changes you have made if you break a file, even if you accidentally delete it. It’s obviously better if you don’t but don’t stress if you do.

You’ll want to play around to see how to add files to the repository, and commit any changes you do make. Please make sure you Commit changes regularly, and Update often too. You may find that you have to Merge changes if two of us have modified a file at around the same time - there is a program called TortoiseMerge that you can use to do this. I’d really encourage you to play around and do this (you can even checkout two versions of the repository to your hard disk and make changes to the same file in each one, and they try to commit, just to see how it works).

Aargh! I don’t seem to be able to get past the wp-login.php page. It keeps redirecting to there.

I am logged in, and using the correct password, but I can’t get through to the admin pages.

I can post entries via ecto, too!

Update: ck has a fix: http://ckon.wordpress.com/2008/07/15/fix-for-wordpress-26-cant-login/

This is a post taken out of context I made to a discussion group in my AI subject. (Which another Matt and I have decided they falsely advertised, and should have called “Expert Systems”). It’s a bit vague in a couple of places, and I will probably come back to this topic at some stage and write a clearer explanation of what I mean. But this is here for now.

I did some thinking about the thought experiment where a guy sits in a room translating English into Chinese, and how “He will probably learn some characters over time.”, and how this is not the same as a machine.

I think it is the same. If a machine is able to recognise a word/character, that is still the same as the man learning it, rather than just memorising it. (I’d actually counter that memorising meanings and symbols is still a type of learning, and I come from an educational background, so I do know a little about learning).

But I want to push even further. A human isn’t the same as a translating program because it can learn new information that wasn’t there when the program was written. If a program is able to incorporate new facts, develop new pathways, and perhaps even rewrite it’s own program, then this is a much closer analogy to what we define is learning.

There are system out there that allow for dynamic reprogramming (I think some derivatives of Smalltalk are pretty good at this), and many systems that allow for dynamic alteration of code (perhaps by an outside source). Even the OLPC project is based on a system which can be changed while it is running.

Our brains are a machine that can alter it’s physical structure in response to the environment - indeed that is how we learn - and the pathways that are used often eventually end up working better than those that are used infrequently. A program could work the same way. Evolutionary programming is another example - an algorithm can be seeded, and then a variety of mutations are generated, and an “overseer” selects the mutations which result in a better algorithm.

I can’t provide any hard quotes, but I know this has been used to some extent to develop novel programs.

I know this is verging on Strong AI, which Darius says is a no-no, but consider this post as having taken place in a pub or cafe. In fact, I’m off to the pub now.

It’s still relatively unusual for me to have to work on a system that I don’t have superuser status on - at home I am the administrator of all of the machines, and at work I have sudo privs on both the development and production servers.

At Uni, however, I have to play by some other dude’s rules.

And, that means sometimes not having software installed that I need.

Take mercurial, for instance. I use this as my exclusive RCS, because it is simple to set up a repo, easy to clone, plays nice with OS X, and with Trac. It’s extensible, and easy to merge changes from clones.

But it isn’t installed as standard, or even at all on the Solaris machines at Uni. SVN is, but I’m not about to go through the whole rigamarole of setting up an svn server again. It just doesn’t do anything for me that mercurial doesn’t but it’s more setup work.

And I create new repos all of the time. I have one for each of my topics, and every time I start a new project, I create a new repository. It’s just that simple: hg init.

So, I tried installing it as a general user. I have it so that it works to some extent: I have the ability to change my environment variables, so I can add ~/bin to my path, stick all of the hg files in there, and then the mercurial/ directory into ~/.python, which I then make my PYTHONPATH.

Then, I can happily use hg while ssh’d in (or logged in to one of the SparcStation machines).

But, I can’t use the remote access.

See, ssh <machine> hg <command> will not work unless a) hg is in the system path, and b) mercurial is in the system python directory. You can fudge the first part (by explicitly telling the local hg where to look for the remote hg) but then I can’t figure out how to tell it where to load the python classes from.

So, my solution is this: mount the folder using sshd (or in my case, ExpanDrive). Then clone the repository from the local machine. You can then happily work away on either machine, but to push/pull you need to have the folder mounted.

Bit of a bummer. I’ve asked for mercurial to be installed, but we’ll see if that happens or not…

I have a custom class, called MultiMatrix, which is basically an NSMatrix that has header rows and columns. Selecting a header row or column will select the whole row/column, and selecting the top-left cell will select the whole table. These header cells will also automatically select themselves if their whole row/column/table is selected.

Because I dynamically update the size of the matrix according to some data elsewhere in my program, I needed to embed it into an NSScrollView, so that when the size exceeds the normal size, then users can scroll to select cells.

I did this, and I was having huge slowdowns. I could select cells alright, but selecting a header cell meant about a one second delay.

Solution: turn off the NSScrollView’s copiesOnScroll.

Even though I wasn’t scrolling, for some reason this was causing big performance issues.

I suspect it’s making my custom matrix class do something lots of times, or perhaps it’s related to the controller and the bindings I have set up. Regardless, unchecking the Copies On Scroll box in IB fixed it.