Prof Hugh's talk on compute security was very inspiring, especially the part about rainbow table. I was wondering after class, if rainbow table seems to be so powerful in cracking password hashes, does it means that our passwords are not secure at all? Out of curiosity, I researched on the defence mechanism for rainbow table and here is what I found:
First of all, adding a salt is a very intuitive approach to defence against rainbow table. A salt is a random data that is used as an additional input in hashing a password. Same password hashed with different salts will result in different hash values. But bear in mind that the salt value must be large enough to make rainbow table ineffective. Otherwise the attack will still be able to precompute the password hashes for different salt values. I think the underling principle of this mechanism is quite common in computer security: instead of aiming for perfect secrecy, you create a computationally secure scheme to defend against attackers with limited amount of resource. This idea works because it is likely that for every single bit increased in the encrypted data, it takes attacker exponential amount of resource to break it, so called 魔高一尺，道高一丈. (Quan Yang mercy please if I am wrong >.<)
Secondly, in addition to adding salt while hashing the password, we can run the underlying hashing function multiple times to increase the amount of times required for the attacker to build rainbow table. This is called Key Strengthening. The response time to validate users' input password will be affected as well but since for each user they only need to hash one password multiple times the overhead is negligible.
Another defence mechanism is even more interesting. Based on what we have for key strengthening, if we remove the salt after we hash the password, normal users and attackers will have to brute force the salt results. This will increase the overhead for normal users in a significant amount of time. But I am not very sure how it helps to defence against rainbow table attack better than key strengthening. It seems that such defence mechanism is only published on a paper and hasn't been put into practice yet.
Computer security is such an challenging and important field in computer science and after what Quan Yang and Prof Hugh had demonstrated in our lectures, it seems to be amazingly interesting as well. I really feel like looking into this area and having some fun myself~
Sunday, November 6, 2016
Monday, October 31, 2016
Taste of mongo
In our final project since there is no constraints about the choice of database, our group uses MongoDB to manage data. It was my first time using NoSQL database and here are some thoughts about it.
As for the advantages, one of the things I really like about MongoDB is that I do not need to write schema anymore. The flexible data model MongoDB provided makes managing data a lot more easier. Basically I can store any type of data with desired structure. I can also dynamically update the data model with changing requirement without any interruption to old data. Based on my research, MongoDB also provides high performance in terms of throughput and latency. So far the amount of data we managed is not large enough to prove the statement but I am looking forward to it.
On the other hand, as for the disadvantages, not being able to do join query makes me feeling quite uncomfortable. Being used to relational databases, join is the one of the most frequently used method to retrieve data from different models with a single query. In MongoDB, the alternative is the "lookup" operation which I have not get used to. Besides,
MongoDB does not support transactions except certain atomic operations at single document level which may lead to data inconsistency.
Sunday, October 23, 2016
Why pixel games are still popular?
Since our final project, FitMi, is designed in pixel style, I research on available pixel games in the app stores and surprisingly find that pixel games, which seem to be a bit outdated, are still popular in the market. But why? Based on my personal experience and some further research, I suspect that these are possible reasons that keep pixel games alive.
One of the most important reasons is reminiscence. Because of reminiscence, developer created pixel games to pay tribute to the pioneers, for example, Super Mario, which bring them a lot of fun in their childhoods. Players of classical pixel games are attracted by new pixel games because of similar reasons.
Secondly, many game developers and organisations are short of man power which means that sometimes they have to do game design without designers. In such cases, pixel game is a rather safe choice due to its simplicity.
Third, pixel games actually enable users to make full use of their imagination. Therefore, for children and teenagers, who are never lack of imagination, pixel game is still a great choice for entertainment.
Moreover, expectations to pixel games are usually lower than the expectations to more advanced games such as GTA5. Since user accept the simple design of the user interface, it is not likely that they expect the game play to be very fancy.
On the other hand, since pixel game cannot afford too fancy game plays, they really have to put in effort to come up with a core feature that is fun. The Binding of Isaac, for instance, is a very good example of simple but playable game. The carefully designed core features keep pixel games attrative for a long period.
Last but not least, considering the large number of pixel games in the market, maybe it is just some of them becomes successful and popular at the beginning. And the success of these games earn users and credit for other pixel games which makes the whole market alive.
One of the most important reasons is reminiscence. Because of reminiscence, developer created pixel games to pay tribute to the pioneers, for example, Super Mario, which bring them a lot of fun in their childhoods. Players of classical pixel games are attracted by new pixel games because of similar reasons.
Secondly, many game developers and organisations are short of man power which means that sometimes they have to do game design without designers. In such cases, pixel game is a rather safe choice due to its simplicity.
Third, pixel games actually enable users to make full use of their imagination. Therefore, for children and teenagers, who are never lack of imagination, pixel game is still a great choice for entertainment.
Moreover, expectations to pixel games are usually lower than the expectations to more advanced games such as GTA5. Since user accept the simple design of the user interface, it is not likely that they expect the game play to be very fancy.
On the other hand, since pixel game cannot afford too fancy game plays, they really have to put in effort to come up with a core feature that is fun. The Binding of Isaac, for instance, is a very good example of simple but playable game. The carefully designed core features keep pixel games attrative for a long period.
Last but not least, considering the large number of pixel games in the market, maybe it is just some of them becomes successful and popular at the beginning. And the success of these games earn users and credit for other pixel games which makes the whole market alive.
Monday, October 10, 2016
Ideas on how to make our app addictive
It has been two weeks since our final project started. Our group is building a health app with digital pet element. During our last consultation Prof provided us some tips on making our app addictive. After further research I summarize the points below and hopefully we will be able to achieve it at the end of the development.
First of all, our app must have a NICE user interface. A successful app should either be cool or cute on first glance otherwise users are like to delete it right after download. Considering that our app is categorized to be a Health & Fitness app, it is likely to be on the cute side.
Second, user should not encounter too much trouble for on-boarding. A bad example for it will be Visor which included unnecessary Facebook login process. We will first allow user to use our app without login and only when user want to switch between devices we will ask for their Facebook or WeChat account.
Furthermore, in order to remind the existence of our app to users, we would come up with certain strategy to entertain user even they are not exercising. Something like a combat among friends will be great. The combat should be directly related to users health data and therefore encourage users to do more exercise. Other than that some interaction between users and their digital pets will be fun as well.
Story line is also important to keep our users. As Prof mentioned during our last consultation, if user feel that they have invested a large amount of time and emotion into our app, they will likely to be more loyal, Therefore, we will include a EXP and level system into our app firstly to help users keep track of their exercising history and secondly enhances the connection between their digital pets and their reality life.
Besides story line, challenges is another element full of excitement and we would like to make good use of that. We would let users set their daily exercise goal and they will be rewarded if they manage to finish the goals. We hope that the sense of accomplishment will encourage them to keep exercise.
Last but not least, game balance is important for any app involving competition. As a gamer myself I fully understand the desperation of somehow losing a game that you are so confident to win due to imbalance. Therefore, since we would like to introduce ability difference into our Mi combat, it would be necessary for us to test our math formula before final deployment. Maybe some kinds of mathematical model need to be build to ensure balance. For more about game balance, I would do further analyze and discuss in next week's blog.
First of all, our app must have a NICE user interface. A successful app should either be cool or cute on first glance otherwise users are like to delete it right after download. Considering that our app is categorized to be a Health & Fitness app, it is likely to be on the cute side.
Second, user should not encounter too much trouble for on-boarding. A bad example for it will be Visor which included unnecessary Facebook login process. We will first allow user to use our app without login and only when user want to switch between devices we will ask for their Facebook or WeChat account.
Furthermore, in order to remind the existence of our app to users, we would come up with certain strategy to entertain user even they are not exercising. Something like a combat among friends will be great. The combat should be directly related to users health data and therefore encourage users to do more exercise. Other than that some interaction between users and their digital pets will be fun as well.
Story line is also important to keep our users. As Prof mentioned during our last consultation, if user feel that they have invested a large amount of time and emotion into our app, they will likely to be more loyal, Therefore, we will include a EXP and level system into our app firstly to help users keep track of their exercising history and secondly enhances the connection between their digital pets and their reality life.
Besides story line, challenges is another element full of excitement and we would like to make good use of that. We would let users set their daily exercise goal and they will be rewarded if they manage to finish the goals. We hope that the sense of accomplishment will encourage them to keep exercise.
Last but not least, game balance is important for any app involving competition. As a gamer myself I fully understand the desperation of somehow losing a game that you are so confident to win due to imbalance. Therefore, since we would like to introduce ability difference into our Mi combat, it would be necessary for us to test our math formula before final deployment. Maybe some kinds of mathematical model need to be build to ensure balance. For more about game balance, I would do further analyze and discuss in next week's blog.
Monday, September 26, 2016
Setting up NGINX as server for Ionic and reverse proxy for Rails on AWS
For Assignment 3, we implemented a RESTful application, Wishes (www.wishful.tk), with Ionic as front-end framework and Rails as back-end server. Regrading the deployment, there is very limited resource on how to setup Ionic and Rails with NGINX on Ubuntu and make them work together. After days of searching and a few trials, I come up with the following steps.
- Install NGINX on Ubuntu 14-04
- Install letsencrypt to get CA certificate
- Update NGINX config to enable HTTPS connection
- https://certbot.eff.org/#ubuntutrusty-nginx
- http://nginx.org/en/docs/http/configuring_https_servers.html
- Setup Ionic
- Install git
- sudo apt-get install git
- sudo npm install gulp -g
- Clone frontend repo onto server
- git clone https://github.com/Wishes-CS3216/Wishes-Frontend.git
- Update NGINX configuration (located at /etc/nginx/sites-avaiable/default)
- http://nginx.org/en/docs/beginners_guide.html
- restar NGINX
- Setup Rails
- Clone backend repo
- git clone https://github.com/Wishes-CS3216/Wishes-Backend.git
- Update NGINX configuration
- https://www.digitalocean.com/community/tutorials/how-to-deploy-a-rails-app-with-puma-and-nginx-on-ubuntu-14-04 (We are using Puma here. Other alternatives are Passenger and Unicorn)
- git clone https://github.com/Wishes-CS3216/Wishes-Backend.git
- update Rails configurations if necessary (under repo/config/ folder)
- start Puma
- restart NGINX
Links to relevant resource are attached here. Hope it can be useful. If you are still confused about the detailed configurations please feel free to comment below. Cheers =)
Monday, September 19, 2016
Lessons learnt from pitches
1. The word "free" has magic power in attracting people. The experiment mentioned by Patrick was quite inspiring. I think the strategy could be applied for onboarding users.
2. People will be more willing to donate money / free stuff if they know that it is for charity purpose rather than for some random strangers. For assignment 3, our group is doing something related to help fulfilling other people's wishes. And one of our main concern is on how to activate users. I think maybe we can reconsider the project scope to add in element like "help local charity organisations". It indeed sounds more attractive and it is more likely to get support from the society.
3. "Don't find target users for your app; find app for your target users". There were two great examples mentioned that indicated such principle. The first one is the Show My Turban site and the second one is the marriage agency for Indian. During my past barnstorming I mainly focus on the pain in my personal life which made my ideas limited. In the future I will also consider the problems faced by people whose life I truly understand. For example. students and teachers in Chinese high schools and NUS, people living in my hometown, etc.. Since I have a deep insight on their lives I guess I am able to come up with something that will make their life better.
4. Users may not use the app as you planned. I personally doesn't believe that the "anonymous Facebook Message“ idea will be successful. Similar functionality was implemented by Tecent QQ a few years ago and the feedback was quite negative since people felt offended and annoyed by mischief. The idea failed mainly because user didn't use the app as expected. I think it is important to think about all use cases for an app during brainstorming to ensure that all of them doesn't contradict with the main purpose of the app. But the good thing is that if one of the use cases contradict with the original ideas and it sounds fun we may create an app for that as well ><
2. People will be more willing to donate money / free stuff if they know that it is for charity purpose rather than for some random strangers. For assignment 3, our group is doing something related to help fulfilling other people's wishes. And one of our main concern is on how to activate users. I think maybe we can reconsider the project scope to add in element like "help local charity organisations". It indeed sounds more attractive and it is more likely to get support from the society.
3. "Don't find target users for your app; find app for your target users". There were two great examples mentioned that indicated such principle. The first one is the Show My Turban site and the second one is the marriage agency for Indian. During my past barnstorming I mainly focus on the pain in my personal life which made my ideas limited. In the future I will also consider the problems faced by people whose life I truly understand. For example. students and teachers in Chinese high schools and NUS, people living in my hometown, etc.. Since I have a deep insight on their lives I guess I am able to come up with something that will make their life better.
4. Users may not use the app as you planned. I personally doesn't believe that the "anonymous Facebook Message“ idea will be successful. Similar functionality was implemented by Tecent QQ a few years ago and the feedback was quite negative since people felt offended and annoyed by mischief. The idea failed mainly because user didn't use the app as expected. I think it is important to think about all use cases for an app during brainstorming to ensure that all of them doesn't contradict with the main purpose of the app. But the good thing is that if one of the use cases contradict with the original ideas and it sounds fun we may create an app for that as well ><
Monday, September 12, 2016
Reflection on Assignment 1
Assignment 1 is over but there are still lessons can be learnt through reflection. What can we have done better?
First of all, we should have cared about security from the very beginning. Two of us were taking CS3235 but yet we put security as our last concern. Not a good practice at all. Choosing a framework that implements more secure features can be a good start. Securing database access by avoiding raw query can be useful. We should have validated user input as well and we should did it when we still have enough time. I guess Quan Yang must feel quite boring hacking our website - "No challenge."
Second, when we split into two groups each focusing on a component of the website, it is important to know what the other group is doing and will the integration work in the end. In our case we implemented Student page and Company page separately but later we found that there was logic flow missing. It was not only the project manager's duty to see the big picture of the website.
Last but not least, since finishing the write-up is so much pain, it is better to answering each milestone once we finished it.
Subscribe to:
Posts (Atom)