Review of Introduction to Secure Computation Article

I recently read an article about secure computation by a undergrad. It was a great introduction in many ways. It clearly outlined and described the idea behind secure computation, how it is developed, and a brief idea of how to implement it. Each graphic included was useful and greatly illustrated the encryptions mentioned in the text.
But above all of those positive qualities, the most outstanding trait of the article is its slow introduction and but gradually more in-depth explanation of each cryptography term, leaving the reader more knowledgeable at the end of the article while leaving links for the reader to peruse if one wants to learn more about cryptography.

Steps to Working as a Pentester

1. Read and follow public information and web security information and news.

2. Be a script kiddy and learn how those scripts run in a safe environment.

3. Write lots of code with validation and preventative measures. i.e. form validation to prevent SQL injections

1. SQL injections - prepared statements, mysqli_real_escape_string()
2. Cross site scripting(XSS) - preventing injected scripts from running on websites i.e. choose to interpret user content as stuff like &lt; instead of <
3. Cross Site Request Forgery (CSRF) - prevent using one time tokens in forms

4. Submit reports to the Common Vulnerabilities and Exposures system.

5. Try them on existing companies with bug bounty systems like Reginaldo Silva did. Remote code executions provide nice payouts but remember to strike the proper balance between ethics, moral, and common sense behavior. Also, try to be upfront about the vulnerabilities presented.

6. If it's at an in house company then make sure they already have a risk assessment and security features and protocols in place for if security is breached. This article mentions steps to take before undergoing a pentest: https://www.cybersecdefense.com/information-security-testing-continuum/

Parser Project

I'm currently working on a project which will eventually need to parse commands or tasks into more usable intuitive responses which make it really easy for people to follow. But I don't know how to make a parser which can deal with organic language.

So I'm going to start looking into those Natural Language Processing APIs I posted a link to last year. Also, I need to learn more about Natural Language Processing itself. So I've got this online class from Columbia I can reference for introductory stuff.  http://www.cs.columbia.edu/~cs4705/ I hope it mentions how to implement some of this stuff. But looking at the initial material about grammars and trees, they will probably be implemented a lot like a compiler is made. But maybe just maybe it'll use deep learning neural networks so I need to look into that a bit since I know nothing about it other than it's a form of AI implementation.

If you know anything about these areas and can help, contact me because I would be glad to get any help on making these materials into code rather than just ideas and theory.

I'll probably use Markov chains in the first form of my parser.

Review of Artificial Intelligence Class Lectures

For the past five months I have been listening to online lectures of an Artificial Intelligence (AI) Class made by Peter Norvig, of Google, and Sebastian Thrun, of Udacity. It is a pretty good lecture series. It after finishing the lectures I definitely feel like I have a good basic understanding of the fundamental processes behind AI, along with an idea of how three core applications: computer vision, robotics, and natural language processing, work. The applications also relate to algorithms, compilers, optical physics, geometry, computation theory, statistics, machine learning, and linguistics because this is where part of their foundations are derived.

The two lecturers do a good job of making their content interesting and relatable. Most importantly they go over material several times to help with reinforcement learning for the students. They also mention the units in later units such as the application units. The applications' mechanics are mentioned extensively so I have a firmer grasp on which areas of AI I want to pursue, namely robotics. I eventually want to figure out Natural Language Processing for my own needs and Computer vision if there's time.

The final also does a pretty good job of covering most topics but it is biased towards the material Sebastian Thrun covers. It is definitely as challenging as an undergraduate class at a well respected university. 

This class is an exciting and thought provoking way to start your artificial intelligence journey. I would recommend you to try it, too!

How Particle Filters Behave

In the online artificial intelligence class I'm taking from Youtube, a video mentions particle filters and how they work.

Initially the particles are randomly and evenly distributed across the whole space, kinda like senators. Then as more information is gathered the particles are redistributed based on which areas have the important information and which areas don't. In fact the areas without the important information might have no particles when the particle filter is completely done figuring everything out.

Back to the areas with important information, they have a greater say in where the next round of particles go until finally the areas with the most particles and the most weight or importance match. So house representatives' distribution in the U.S. is kinda like the particles, except every representative has the same weight in the U.S. legislative branch.

Enigma and Algorithms

Conclusion: An enigma machine uses an algorithm taught in many algorithms classes for computer science students.

According to someone else, a similar algorithm is used by our brains to make rapid fire decisions.

Mistrust of Technology

Even though I have an above average knowledge of technology and the innerworkings of how it's made, I have a deep seated mistrust of technology. It has appeared in various ways. For example, I am hesitant to store my information in the cloud of other companies even though retrieval of lost data would become much easier along with easily reachable backups.

Perhaps the mistrust of technology in other people's hands is because I know security is not 100% guaranteed, as is evidenced by hacked celebrity accounts. Especially when a part of security involves the human memory, the chance of failure is higher. Also, in the agreements signed to use products, there are not very clear and explicit details concerning how one's own personal data is stored or accessed by the company itself.

Also, there are companies who are explicit about using one's personal data for profit in advertising. Then there are all the cookie trackers which exist and tell websites where the user was before browsing their website, which link was clicked, which other websites they are logged into and a bunch of other information.

Therefore, my mistrust of technology, in other people's hands are grounded in past failures by companies to handle my information in a manner consistent with my security concerns.

Daily Commits

In a few days I'll be working to make daily commits. I hope it goes well. I'll be working to make the Baymax interface real, home automation, or a website for work but whichever I choose, I'll stick with it for 21 days. We'll see what comes of it.

Body Scanning

In futuristic movies, many robots or buildings scan people. In the latter case, they scan the humans to make sure they are the ones allowed to enter the building. In the former case, sometimes they want to allow entry to areas too.
But the robots also scan humans for health. This would be an extension of x-rays and MRIs which scan the brain and check bones. But when a robot does a full body scan, does that mean they have an built-in -ray machine and MRI? Also, they must do a superficial check for injuries and the like, right? So what would they use in comparison? An idealized image of a human's skin texture and which limbs they should have?
Also, Baymax in Big Hero 6 scanned Hiro for his health. So Baymax would also need a pheromone detector for different levels of chemical emissons from Hiro. So those robots are combining technologies. In checking for cuts, robots would have to check for things such as exposed blood. but more shallow cuts, like paper cuts wouldn't necessarily have blood. Therefore, such a scan wouldn't work universally yet. Also, do those robots do a 2-d scan or a 3-d body scan? If it's a 2-d scan then image processing like for barcodes with python and OpenCV would work for doing a basic scan of humans too.
Here's a link of an article which detects barcodes: http://www.pyimagesearch.com/2014/11/24/detecting-barcodes-images-python-opencv

Online Anonymity

Achieving anonymity online is a tough to near impossible task. One of the first suggestions of online anonymity is to use Tor which can only safely found through the direct website, https://www.torproject.org/ . Next is VPNs but only through the trusted ones and even then you must do your research and fully trust them in other to use the VPNs because using the wrong VPN means there could be logs of your internet usage.

But one problem with Tor is sometimes it is so rarely used that correlation attacks can be made on the few people who use it. For example, if you're the only person in the Ukraine who uses Tor even though you, yourself, is hidden, the Tor connection from the Ukraine is still visible and can still be traced back to you.

However, if a software or something could generate Tor usage from multiple locations and same or similar times in similar locations or could somehow route your location to somewhere else, there would be less risk of being discovered when you're using Tor. For there would be mutliple links to track. But how would this software or idea be put into play? Would it have to be like a Trojan? And it systematically activates a Tor connection? Or could it be open source and collaborative where people opt in like Stanford researchers do to unravel genetic folding? The opt in seems better and less risky. Also, there's also less risk of running afoul of powerful people, especially since one of the points of using Tor is to eliminate dangers.

SQL Column Name Differences

In MySQL, column names are escaped using the back tick like `miles/hour` but double quotes can be used, "miles/hour" when ANSI mode is enabled. This is important because regular SQL does not support back ticks and PostgresSQL only supports double quotes.


So, when setting up your database to be ported into any language, make sure to enable ANSI mode in MySQL and use double quotes around any column names with special characters.

How to Play Mental Poker Summary

I read a cryptography paper on "How to Play Mental Poker" by Goldwasser and Micali. I can't remember all of it and so I'll only put what I remember on here. I may have remembered some of it wrong but bear with me. It's basically a combination of ideas. It uses RSA and another guy whose name starts with R's elaborations on their idea. The paper then discusses how RSA can work with the coin flipping technique of probabilistic encryption to play Mental Poker. RSA works with some stuff squared times mod it being it answer. It has to do with primality and how it's really hard to figure out if a number is prime without already having its factor. There's the primality test though that many systems use as the basis for finding prime numbers. So then the two players in the mental poker game each encrypt a stack of 52 "cards." Then, the other player draws from the opposing player's deck, then removing the same card from his/her own deck so there are no duplicates. They are given a key by the owner but the owner still doesn't know which card the opponent chose because that key reveals nothing to the owner, since the owner has insufficient information. They play until they find out if its secure or someone wins.
Some downfalls of this method is unintended adversaries may still intercept messages and understand them without knowing full well what the message contains. So it cannot be used for messages which need this kind of encryption but it works for all the others.

Authenticated Encryption vs. Symmetric Encryption

Authenticated Encryption(AE) is a form of Symmetric Encryption. The goal of authenticated encryption is to encrypt or conceal the data as well as confirm the identity of the sender. However, I do not think the situation calls for confirmation of the receiver. Symmetric Encryption does not imply authentication. Therefore, a tag must be added at the end of Symmetric Encryption messages. The tag will then be MACed. So AE is actually a combination of Symmetric Encryption and Message Authentication Codes (MACs).

AE can be implemented using Symmetric Block Ciphers but there are also various other ways to implement it, too. The difference in AE and plain block ciphers is an extra block cipher at the end of AE which is hashed using different inputs. This extra block cipher with a different key makes it that much harder for an adversary to break the encryption of the chain of block ciphers.

Privacy Transparency

I came across a research programming language, Jeeves, related to privacy, which led me to the author's blog post about privacy and stalking viewers. A link on the blog post linked to a WSJ widget which tells people who browse to that page some of the various information that people expose just by visiting a webpage. Here's the widget for anyone interested: http://datatransparency.wsj.com/

It was a very disturbing realization. Privacy is mentioned all the time but it's a hard hit to see it happen personally.

Fictional Cryptography Story

I watched a youtube video that says fiction makes human brain smarter: http://www.youtube.com/watch?v=RYpofvqVxzc
Then, I searched up computer science fiction and found nothing much. But, I did find this site: http://blog.regehr.org/ and I thought it was interesting so I put it in my tech links.
In an attempt to understand computer science better, I decided to write a story about computer science, particularly cryptography. I ended when the next sentence for the story no longer flowed out of my brain. I hope you enjoy the story's attempt to teach an aspect of computer science to people, even if it is partly or mostly fictional and inaccurate.


The Story:
There was a girl who loved computers since she was five. She would always use them to play games and code. Then, one day she found a bug in a program she was using. As she attempted to fix the bug, she became ever more engrossed in cryptography because it seemed like a simple problem of how to hack away at the program since she did not write it herself. She first attempted the problem as if it were a formed from a pseudorandom generator. She knew a pseudorandom generator was a black box which spits out faked or not faked random numbers. But users cannot tell if they are fake or not, just like she couldn't tell in this case. But she tried to figure it out all the same.

So, she first attempted to tell if they were fake by trying to see if there was any decipherable pattern. She tried to match them up, pair them. It did not work. There were just too many numbers in the subset containing the fake numbers and even in the set of the truly random numbers. Deep into the night she worked.

Hours later, she was stuck. Making not progress, she finally glanced at the clock on the right hand corner of her screen only to discover it was already 3 a.m.

She didn't know how time had flown by so quickly but frustrated she decided to sleep and attempt to solve the problem again the next day. 

Installing Python packages on Windows machines

Python.org
First you must download setuptools.
untar it
C:\Users\username>cd Downloads\setuptools-1.4
C:\Users\username\Downloads\setuptools-1.4>python setup.py install
C:\Users\username\Downloads\setuptools-1.4>cd ..\..
Instructions to install packages on Windows
It says it's for Windows 7 but it works for Windows 8 also.

Making a basic website on a school computer science account

Assuming you already have an account with your school's computer science department, running linux,
1. Open Terminal

2. In terminal execute the following commands:
chmod 711 ~
mkdir public_html
chmod 711 public_html
cd public_html

 

3. Now, you are in you public_html folder, while in there make a new index.html file:

option 1:

vi index.html

press the i key

type "Hello World"

press esc then :wq

proceed onto step 4

option 2:

go to your regular file system and create a index.html doc with your favorite basic editor then save it into public_html

 

option 3:

cat > index.html

type "Hello World"

press ctrl+D

proceed onto step 4

 

4. In terminal
chmod 744 index.html

Now you have your first empty webpage!

5. For more webpages, repeat steps 3 and 4 but with a name other than index

4 types of cryptography

Cryptographics problems have to do either with authentication or privacy. Two ways of solving these problems are with symmetric and asymmetric knowledge between the two good players. For symmetric privacy, there's symmetric encryption. Asymmetric privacy = asymmetric encryption. Symmetric autentication = MAC. Asymmetric authenticatin = digital signature. Now, keep these four different cryptography problems in mind when learning or reading about cryptography. Have fun!

Action Bar item Works

I finally got my action bar item to work, but only on an activity  that isn't my main activity. Also, the icon is wrong since I don't have an activity to do it yet (search). But it works! All I did was follow what is in the Android tutorial. One thing I made sure was (since this action bar has an up/home function) to add the new action bar items before the home item. That might not be the fix but it worked this time so I will assume it was the fix until proven otherwise. 

Also, i need to remember these things about git:

cd to the correct folder

git status

git commit -a

git push

my git password

Yay! Now to work on adding a database to my app. This is all so exciting! I am so glad to be making progress. 

IP Addresses all Doled Out

I learned about Networks and they kept talking about 32-bit addresses and the textbook kept saying that IP has so and so many addresses. I looked at the number and it was not very large, not at all compared to the number of devices that I know are connected to the internet and the number that might need to be connected soon. So then I asked, "Won't the internet run out of IP addresses?"
Even with proxies and masking, IP addresses are still being used. So then the book counteracted many sections later, maybe even chapters later. Since I'm a slow reader, this was also weeks later.
The book then introduced IPv6 and showed the number of possible slots. Knowing the number of humans in the world and the number that IPv6 could hold, I no longer had any fears that IP addresses would run out with the new schema. So that answered my question.

This youtube video also attempts to answer the same question I had regarding IP addresses: http://www.youtube.com/watch?v=8d49sEAU5Ws