by Bozho | Dec 15, 2015 | Aggregated, Developer tips
I decided to do a prototype for an electronic identification scheme, so I investigated how to do TLS client authentnication with a Java/Spring server-side (you can read on even if you’re not a Java developer – most of the post is java-agnostic). Why TLS client autnetication? Because that’s the most standard way to authenticate a user who owns a certificate (on a smartcard, for example). Of course, smartcard certificates are not the only application – organizations may issue internal certificates to users that they store on their machines. The point is to have an authentication mechanism that is more secure than a simple username/password pair. It is a usability problem, especially with smartcards, but that’s beyond the scope of this post. So, with TLS clientAuth, in addition to the server identity being verified by the client (via the server certificate), the client identity is also verified by the server. This means the client has a certificate that is issued by an authority, which the server explicitly trusts. Roughly speaking, the client has to digitally sign a challenge in order to prove that it owns the private key that corresponds to the certificate it presents. (This process can also be found under “mutual authentication”) There are two ways to approach that. The first, and most intuitive, is to check how to configure Tomcat (or your servlet container). The spring security x509 authentication page gives the Tomcat configuration at the bottom. The “keystore” is the store where the server certificate (+private key) is stored, and “trustStore” is the store that holds the root certificate of the authority that’s used to sign...
by Bozho | Dec 1, 2015 | Aggregated, Opinions
On the conference where I spoke about e-voting, I had another talk that focused on e-identification (which is a mandatory step for e-voting). It is in Bulgarian and EU context, given the new EU Regulation that aims at cross-border e-identification. Nearly 2 years ago I did a campaign for that, not knowing the European parliament is already discussing the matter. In short, e-identification is the means to prove your real identity online (to both the public and the private sector). That sounds very convenient. But I know many people are concerned about privacy. And they should be. But not having a national ID card, and not having an e-identification scheme is not the solution. The US and the UK don’t have ID cards or even a citizen database (which all ex-socialist countries do have). And yet, US and UK citizens are ones under the highest levels of surveillance. On the other hand, the practical advantages of having a way to prove your identity online, especially when working with the public sector (but not only), are not to be ignored. Therefore, here are my slides: You will notice that privacy is addressed in a very concrete way – it is not that the government doesn’t have access to one’s data – it already has, through all of its databases that store records about properties and card owned, current address, driver’s license, etc. Privacy is addressed by giving control to the citizen. He sees (and can be notified) about each and every time data about him from a given database (register) is accessed. The citizen also has control (including the ability...
by Bozho | Nov 15, 2015 | Aggregated, Opinions
Convention-over-configuration is a convenient thing. Instead of writing tons of configuration in xml/yaml/json/whatever, you simply know that something will have a given default value. For example, the restful endpoint URL may have a value of /class-name/method-name, or a join table will be named mainEntity_joinField. A “view” can be populated by default with the input parameters of the controller method or other values. And this is all very nice – we don’t want to annotated each field of a java bean, and we don’t want to configure explicitly our maven directory structure. But there is a “darker” side of convention-over-configuration, and it comes whenever the knowledge of the default behaviour is needed in order to understand the code. Imagine you open a project for the first time. I have had the need to do that recently – as a government adviser I sometimes have to do a quick-fix or a quick investigation of some software that would otherwise require a tender, a contract and at least 4 months to handle. I agree it’s a rare usecase, but bear with me. If, for example, a web framework automatically includes /views/header.ext into your views, and you try to find “where the hell is this menu item coming from”, you may have a hard time. If you try to figure out what controller handles the /foo/bar/baz URL, and you don’t find any configuration or mapping file, nor you find any part of the URL using the search functionality, you’re lost. Convention-over-configuration can roughly be split in three groups: straightforward removal of boilerplate code, specific configuration logic and stuff that doesn’t matter for investigating...
by Bozho | Nov 13, 2015 | Aggregated, Opinions
Last week I gave a talk on the OpenFest conference about (remote) e-voting (or internet voting/i-voting). The talk was not in English, but here are my translated slides: I’ve addressed some of the topics from the presentation in a previous post. Overall, it’s a hard problem, with a lot of issues to be addressed and it must be treated seriously. However, we must do it, sooner or later, as it will allow for a more dynamic and direct...
by Bozho | Nov 1, 2015 | Aggregated, Developer tips
Yesterday I decided to setup CloudFront for Computoser. I store all the generated tracks in AWS S3, and every time a track is played or downloaded, I was making a request to S3. Not that the traffic is that much, but still it sounded like a good idea to use a CDN (CloudFront) – it would save a little bit of money (not that the current bill is any big) and it would make download faster accross the globe. To be honest, I didn’t do it for any of these – I was just curious how would a CloutFront setup work. There is enough documentation on “How to setup CloudFront with S3″, and besides, the UI in the AWS console is pretty straightforward – you create a “distribution”, in “Origin” you specify your S3 bucket, and that’s it. Of course, you can use your own server as origin server, if you don’t store the content in S3. Then you wait for around 10-15 minutes, and things should work – i.e. when you access http://randomkey.cloudfront.net/foo.png, it should be opened. But for me it wasn’t – the response was “Access denied”. Which meant the bucket policy had to be changed (as described here): { "Version": "2008-10-17", "Statement": [{ "Sid": "AllowPublicRead", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::bucket/*" ] }] } Then the application had to be configured to use CloudFront. This can be done in two ways: In the view – in your pages you can set the root of the CloudFront, and make all references to CDN-available resources absolute In a controller (or anything back-end) –...
Recent Comments