Designing a secure login system is hard

I know from my past experience that designing a secure login system is hard, but I was forced to look into it recently as I was trying to build something as a side project. The article provides a good overview of the various systems that needs to be implemented

• Secure password storage
• Long term persistent authentication
• Account recovery

and talks about tips and pitfalls for each step:

• Store hashes of password in the database, but don't use broken hashes like MD5 and SHA1.
• The suggested "acceptable" password hashing algorithms are Argon2, bcrypt, scrypt and PBKDF2.
• Use dropbox's zxcvbn to estimate the strength of the password and only accept passwords of sufficient strength.
• It is easy to end up with insufficient randomness so use the proper ways to generate random numbers! On this note, I always run into performance issues regarding randomness (such as lock contention in urandom_read for security purposes).
• Timing attacks -- string comparison of authentication token may result in the attacker guessing which character in the authentication token is wrong. The solution to this is to store the hash of the authentication token and compare the hashes.
• Rate limit things! This will help if the attacker is going to brute force his way.
• Reseting password is a backdoor access and it is scary to implement one yourself.

In my mind, a login system built onto of Facebook login integration (or Google Identity platform) would solve the problem of secure password storage and account recovery. The only thing that is left to implement is the following:

• Integration with Facebook login or Google Identity platform
• Generation of authentication token and storage of it (database on the server and cookie on the client)
• Verification of authentication token

The world wide web is a scary place and full of scary people. I don't like it and I don't trust the people out there and they are out to get us. Stay safe and don't trust their inputs!

Musings from work

I admit that I do a terrible job in writing unit test to test out things and I am much more skillful at debugging massive systems (across > 100 machines). The other day my co-worker asked me how to test a C++ class' private method. I didn't know the answer and decided to google it. My eyes hurt after looking a some proposed solution -- some random internet dude suggested to do the following in unit tests:

#define private public

I almost died on the spot when I saw it. The better solution turns out to add the tester class as a friend class to the class to be tested.

Man, I wish I have more time to write more code.

Thank you

It has been a while as always -- too many (perceived more important) things to do, too little time, blah blah. I was thinking about things while showering and wanted to make a list. So here it goes:

• I would like to thank my parents, my family for their support, love, everything throughout the years.
• My friends have always been great to me -- always around when I needed help and support. Thank you, friends.
• I am gratefully that I am still not fired as I broke a lot of things in the past couple of months while working on messaging (the list includes breaking group chat for less than an hour, no messaging ability for newly created pages and so forth).

Blue skies

The sun will be gold and the skies will be blue, when you're holding me, and I'm holding you. We'll pace ourselves until the sun steps over the hill. 

One thing I realized while I was back in Singapore was that the buildings and the trees were tall. They block out the sky and you had to look up to see the blue skies. The sky is less blue compared to California. Did we ever have clear blue skies in Singapore?

Garry Kasparov

So there was a talk and here are some interesting quotes from it:

"In chess you have fixed rules and uncertain results. In Russian politics, exactly the opposite"
"My least favorite line to wait in is the airport security line."
"Peaceful revolution in Russia. I hope Putin doesn't finish his current term."
"Yeah, I've played World of Warcraft with my son. It's kind of your duty as a father." about what video games he play

"International conflict has sadly been the biggest incentive for innovation. Without it, innovation is resisted because it generally destroys jobs before it creates jobs."
"This country got a black president before it landed on Mars because its priorities changed, even though that would have looked unlikely in the sixties. When people ask me what the point is of the Space program, I ask them back if they enjoy using cell phone technology, which is the result of that program."
About Facebook and the internet: "Someone who lives in the desert today has access to more information than Winston Churchill had over his entire life. I don't think we've really felt yet the result of a billion people being able to work together."

Trust

I was visited by a history teacher from Victoria School, Mr Khoo and I brought him and another of his friend around the campus. We had many discussions and I felt that the following was worthwhile to record down:

I was asked the question about my working hours and my response was the hours are flexible in the sense that you can come and go anytime you want as long as you are there for meetings and you get work. Personally, I had never had the feeling that I had no work to do because there is never ending engineering work to do and I have to prioritize what is more important than others (here it is basically which work results in the most impact factor since that is what my performance is based on).

I have the freedom to choose what projects or areas to work on because managers have the job of ensuring that people under them are motivated so that they can perform as best as their ability. But for the system where there is so little structure to work, it would require managers to give constant feedback about how everyone is performing and to identify the under-performers and help them improve. This also means that people are asked to leave when they are under-performing consistently (the mentality I guess is that since they hired the best, people should be performing with the constant feedback) and sadly, the happened to a few people that I know of. Yishan wrote a nice writeup on quora: https://www.quora.com/Engineering-Management/In-a-growing-tech-company-what-are-the-most-valuable-things-on-which-an-engineering-manager-should-spend-time/answer/Yishan-Wong

Everything boils down to trust.

Spring is here

It is my first encounter with spring and it has surprised me much. When I came back from Seattle and went to work the next day, I saw cherry blossom all over the place. I wasn't expecting to be welcomed to spring in such a lovely manner. Sure, I had seen cherry blossom in Hokkaido and it looks nicer there, but there is a certain charm to be surprised by spring.

Sadly, daylight savings is looming. 10 March is the date.