Programmatic Encryption in Java

I'm working on a program in my spare time that requires, among other things, storing a user's password. To avoid storing the password in plain text, I dug around the internet and cobbled together code that will encrypt and decrypt the password. Here's the code:

import javax.crypto.Cipher;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;

private static final char[] password = new char[] {/*array of any number of
   random characters*/};
private static final byte[] salt = new byte[] {/*array of 8 random bytes*/};
private static final String ENCRYPTION_ALGORITHM = "PBEWithMD5AndDES";
private static final PBEKeySpec key = new PBEKeySpec(password, salt, /*random 
   number, doesn't really matter what the number is*/);

private String decrypt(String value) {
 return crypto(value, Cipher.DECRYPT_MODE);
}

private String encrypt(String value) {
 return crypto(value, Cipher.ENCRYPT_MODE);
}

private String crypto(String value, int mode) {
 String result = "ERROR";
 try {
  Cipher cipher = Cipher.getInstance(ENCRYPTION_ALGORITHM);
  cipher.init(mode, SecretKeyFactory.getInstance(
    ENCRYPTION_ALGORITHM).generateSecret(key),
    new PBEParameterSpec(key.getSalt(), 
key.getIterationCount()));
  result = new String(cipher.doFinal(value.getBytes()));
 } catch (Exception e) {
  log.info("cryption failed: " + e.getMessage());
  e.printStackTrace();
 }
 return result;
}
 

RESTful Web Services using Eclipse and Jersey

Axis2 wraps everything in XML, and some people prefer Eclipse over Netbeans, but developing a RESTful web services project in Eclipse without Axis is possible even though it is not straight forward. Here are instructions to create a RESTful web services project in Eclipse without Axis:

Setup

1. Download Eclipse IDE for Java EE Developers (as opposed to Java Developers) from http://www.eclipse.org/downloads/
2. Download Glassfish from https://glassfish.dev.java.net/downloads/v2.1-b60e.html and follow the instructions on the web page.
3. Download Jersey 1.1 from https://jersey.dev.java.net/servlets/ProjectDocumentList
4. Install the Firefox "Poster" add-on
   

Create the RESTful web service project

1. Create a new Dynamic Web Project that uses GlassFish v2.x for the Target Runtime
2. Right-click in the Servers view and create a new GlassFish v2.x server
3. Create a new package in the Java Resources folder
4. Create a new Java class in the new package in the Java Resources folder (hereafter referred to as class A)
5. In the Properties for the project, on the Java Build Path page, in the Libraries tab, click on "Add External JARs"
6. Find the jsr311-api*.jar in the folder you installed Jersey to, and add it as an external JAR
7. Add the @Path("insert_a_path_here") annotation right before the declaration of class A
8. Add a method to class A that has the @GET annotation and the @Produces("application/xml") annotation right before the method declaration
9. Create another class in the same package as class A (hereafter referred to as class B)
10. Add the @XmlRootElement(name="insert_a_name_here") right before the declaration of class B
11. Add some random fields to class B and generate getters and setters for them
12. Add the @XmlElement annotation from the javax.xml.bind.annotation package right before the getters
13. Modify class A to return a new instance of class B
14. Replace the contents of the web.xml file in the WebContent/WEB-INF directory with
    
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xsi="http://www.w3.org/2001/XMLSchema-instance" schemalocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<servlet>
<servlet-name>ServletAdaptor</servlet-name>
<servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>ServletAdaptor</servlet-name>
<url-pattern>/resources/*</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>
30
</session-timeout>
</session-config>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
</web-app>


15. Right-click on the project and choose Run As->Run on server.
16. Open the Poster plug-in in Firefox and run a GET request on http://localhost:8080/insert_name_of_dynamic_web_project_here/resources/insert_the_path_specified_in_the_annotation_for_class_A_here (modify port numbers as necessary depending on output of GlassFish application deployment in the "Console" tab)
17. You should get a XML response with the data from class B
18. El fin!

Note: if you want to return a list of objects, use the following annotations before the getter that returns the list:

@XmlElementWrapper
@XmlElements({@XmlElement(name="element_name")})

where element_name is "suggestion" in the example XML below:

<suggestions>
<suggestion>a suggestion</suggestion>
<suggestion>another suggestion</suggestion>
</suggestions>

Also note that the web.xml and sun-web.xml contain the two parts of the URL before the part specified by the @Path annotation.

Scalable Online Discussions

Large discussions such as the debate over national health care in the United States could be aided if people could discuss issues with each other more effectively. Generally, the pros and cons are not all gathered together into one central location - news outlets and blogs post their opinions on options they believe are best, and some even discuss both sides of the issue, but both have difficulty doing a complete treatment of the discussion. Invariably, points are left out either through ignorance or bias. But if a central discussion page were to be created that would allow all people to publish the points in the debate as they see fit, if the points were consolidated to eliminate duplication, if points were ranked by importance, and if methods were made available to allow people to collaborate about conflicts regarding the combination of points and their relative importance, the discussion could be rationally made and more people could be educated and convinced as to the rightness of the right side of the discussion.

Discussions of all kinds could take place, from the best way to fix local community problems to choosing the appropriate response to actions by multinational companies and states. Some problems need to be resolved, such as preventing a few people from stifling the opinions of others by removing points simply because they have a majority of users of the site, and to provide proper communication methods to allow people to quickly and effectively discuss resolutions to conflicts. Perhaps the site hosting the discussion pages could provide voice communication so that people can talk to each other. Methods would be put in place so that groups can choose a moderator that would take charge of giving people the floor, and methods to replace moderators with a vote in case the moderator is stifling the opinions of the opposing side of the discussion and to take the floor away from someone that is either intentionally not contributing to the discussion or is attempting to filibuster and the moderator is not already taking the floor away from said person. Such a communication system would also have to support perhaps millions of listeners and participants. The system could also allow the division into groups so that more people can voice their opinions rather than having to wait in a line of 10,000 people.

Why I Have Not Bought an iPhone

I haven't posted in a while, so here's a post.

I haven't been keeping up with technology recently. Although I wrote some posts about the "fighting" between the hackers and Apple, I have no intention of owning an iPhone. Despite the dramatic price reduction of the 3G over the original, the cost is still to high for me to get one, and the benefit is low.

At the moment, I have a cell phone that cost about $100 that I bought specifically for its camera. With a convenient camera that is small and I should always have with me, if I'm ever in a minor accident, I can just swap information with the other driver, take some pictures proving it was not my fault, then move on. The cops don't seem to care about minor accidents, or at least the minor accident I was in a couple of years ago in a private parking lot that resulted in a dent in the van I was driving. They told me that all they could do is say that the other driver and I were present.

The phone I bought also has some nice features like a calendar, but I still use my paper planner for organizing my time and keeping track of that which I need to do. I find writing in a paper planner to be more convenient than trying to type on a tiny keyboard that is not sufficiently large to allow me to assume the hand positions necessary to type quickly.

As for being able to browse the internet, I have not suffered from not being able to check my email during the times that I am away from a computer. I figure that if someone urgently needs to contact me, they can call me. If they need to contact me, but it does not matter how soon I respond, they can send an email. I try to make sure that I check my email at least once a day (which is easy given my need to use a computer for work and school) which is a sufficient response time for most email communication.

Although the internet can help if I become lost between destinations, or if I want to find a store nearby my current location for something I need, another device does a better job in both cases: a GPS navigation system. A GPS system knows exactly where I am and what I need to do to get there. The GPS system my wife gave me for Christmas can also find places of interest near my current location, wherever that may be, in those rare circumstances that I need to find a store I was not planning on finding before I left a location with a computer.

All in all, I do not see a benefit of owning an iPhone that makes it worth the additional cost over my current cell phone ($100 to buy a phone with a decent camera, $0.18/minute which averages to about $20/month for me since I hardly use phones).

As a side note, I was thinking today how nice it would be if there was a service somewhere in the world that provided free encrypted file storage. To make the system feasible, each client would have to have special software that handled the encryption and decryption of the file system, including managing the keys, so that the user does not have to deal with them. To the user, it would be as if they were using a network file server. To the company running the servers, they would be seeing a bunch of encrypted data passing back and forth between its servers and its clients. The client software would handle the keys and not share them with the servers so that no one that has access to the servers can view the data the clients store there except the clients that own the data. The software used by the clients would have to be open source so that people could be confident that the company hosting the servers has not programmed the clients to send the keys to the company so they can view the data.

As for which encryption would be best, I'm not sure. RSA would do the job, but it isn't necessary since the same person that encrypts the data will decrypt the data. The person would have to be able to copy down the encryption key so that if the client's computer dies, they can still get setup on another computer and access their data. The benefit of such a service lies in the backing up of the data on the remote servers. People would not have to backup their data on their own, and they would have the added benefit of being able to access all of their data from any location that has access to the internet without the problems of USB drives (the limited number of writes before they die, viruses, compatability).

Open Source and Free Software

Neither the Open Source movement nor the Free Software movement are strong enough to topple the commercial software industry. The progress on software projects developed by the community can be slow at times, and it can be difficult to keep up with commercial products. The people who work on community software must have jobs to generate income since it is difficult to profit from community software, thus they can dedicate only a limited amount of time to developing community software. Granted, some companies have employees who spend their working days developing community software, but those companies must also pay attention to their profits to stay in business. Therefore, the work done on community software by such companies is limited. Due to these limitations, community software will not replace commercial software as long as we live in a capitalistic society. Someday, I hope we all can live in ideal society, but today is not that day.

Family Internet Safety

Some of the advice to parents to help them protect their children from the perils of the internet is wrong - like advice on filtering and supervision.

Filters can be more harmful than helpful. Sometimes filters go too far and block sites that contain extremely helpful information. Having objectionable sites blocked is beneficial, but smart browsing is more useful than filtering.

As for supervision, putting the family computer in a place that is clearly visible and frequently passed by is helpful in encouraging users to avoid objectionable material, but reviewing the browser's history and talking to the parents of friends about the methods they have implemented to keep their kids safe to make sure your kids are safe is too much. All you can do with the browser's history is realize your kids have visited sites, but it doesn't tell you their reaction to the sites. The kids might have closed the window immediately, or the kids might have lingered on the site for a while. As for talking to the parents of your children's friends, what will you do if they don't do much to keep your kids safe? Will you tell your kids they can't go over to the homes of their friends because the parents of their friends don't filter the internet, even though their friends browse smartly? The solutions presented by filtering and supervision are best solved by properly teaching your kids smart browsing. As your kids learn to browse smartly, they will be prepared to avoid evil as they use the internet at locations outside of your control - including the homes of friends and the public library.

iPhone Wars

The hackers have made more headway in the war against locked iPhones. Now iPhone users can unlock their iPhones without rendering the phones unusable.

Apparently, the hackers have pledged to modify every new update Apple publishes so that the unlocked phones are never rendered useless again. But a security issue arises: how does one know the hackers aren't adding anything malicious to the updates? They could modify the updates to grant them access to the phones. How would one know? Anything that can affect your computer can affect your iPhone, like viruses and spyware. Is slightly better customer service worth the risk of an insecure phone?

In other news, the iPhone will be released in China at some point in the future. It makes me happy to know that people around the world are benefiting from the improvements of technology. On the other hand, many people in the world are unable to enjoy life as they go without adequate food and shelter.

More news on the iPhone:
http://www.wired.com/gadgets/miscellaneous/news/2007/11/iphone_china
http://www.itwire.com/content/view/15433/1103/1/0/

Software Patents

Lets say you alone develop and sell software that becomes wildly popular. As you dream of the things you will buy with your coming fortune, a software company develops software that does the same things your software does, except the company sells its software for less and does a better job marketing and maintaining the software. As your dreams of luxury begin to fade with the realization that the software company will inherit your coming fortune, you wish that you could stop the company from stealing your idea. Something exists to prevent others from stealing your idea, and it has been around for many years: patents.

I'm for software patents. If people cannot patent their software ideas, they will be less likely to research better methods without the ability to make money from their improvements.

Software patents not only help large companies, they also help small companies and individuals. If a small company develops a unique software program and patents it, they can profit from it while the larger companies must either pay royalties or find a better way to do the same thing - thus driving progress.

Software patents don't hurt those who don't patent their ideas. If someone can prove the idea existed before a big company came up with the idea, the big company will be unable to patent the idea.

In an ideal world, better algorithms will be shared without charging money, but we live in an imperfect world. We live in a capitalistic society, and we must follow the rules of that society if we are going to progress together. Too many people would take advantage of the system if everything was free, and society would not progress if everyone was a thief.

Only Two iPhones Per Person

iPhone news: http://www.informationweek.com/blog/main/archives/2007/10/want_to_pay_cas.html

Apple has taken another step in combating the hackers. Now Apple sells only two iPhones to each person. Apple can restrict the distribution of its cell phones any way it wants as long as it follows the law.

Many people complain that Apple's actions are unfair. What is fair? Do people think fair means getting what they want? If a person doesn't like Apple's new policy, they should stop buying Apple's products: money speaks louder than words. But iPhone sales are doing well. The people have spoken: they like the iPhone more than they hate Apple's policies and methods of distribution.

Women in Computer Science

Women should be treated equally in the field of computer science, they should be encouraged to be mothers, and they should be encouraged to pursue a career in computer science if they so desire.

As long as women have the same opportunity as men to enter the field and be successful, nothing more should be done. Discrimination against women solely based on their gender is not just. But one must be careful in completely eliminating gender-based discrimination without careful consideration. Forcing equality between men and women can lead to problems worse than unjust discrimination. During the time the Equal Rights Amendment was publicly debated, good reasons were given against passing the Amendment. Although most of the reasons are unrelated to equality in the field of computer science, they hint that some undiscovered reasons may exist that we are unaware of.

Third-Party iPhone Application Development

Apple chose wisely to allow others to develop software for the iPhone. Not only can others profit from the popularity of the iPhone, fewer people will try to hack the iPhone to develop on it, thus making it more secure as the malicious hackers can no longer rely on the efforts of others to hack into the phone. But this decision will not make the iPhone completely secure: there will always be ways to break into it. Information on any electronic device will be completely secure only when the device is melted into an unusable mass.

Article on iPhone Development: http://www.informationweek.com/hardware/showArticle.jhtml?articleID=202403919&subSection=Macintosh+Platform

Computer Security

Hackers vs. IT Security

A strange war rages between information technology security guards and hackers. IT security guards do everything to keep hackers out, but hackers continue finding ways to cause damage. The war is like a sword fight with one guy spending the fight dodging the other guy's sword without using his own sword to strike back and stop his opponent. This epitome of a defensive strategy fails to stop the attack. There are some IT security guards in the world that pursue the hackers, but the chase can waste money. The guards could spend an incredible amount of time and money chasing the hackers, or they could spend less money on improving systems to keep hackers out.

For the number of hackers to be reduced, they must be pursued. The security guards should implement systems that can identify the hackers enough to prosecute them. The automation of the task will reduce the cost of the pursuit. The FBI should implement a nationwide monitoring system with the ability to trace a hacker the instant the FBI is notified of an attack. As soon as the hacker is traced, the FBI should find the hacker's home address, find out who in the home is the attacker, and arrest the culprit. To increase the effectiveness of prosecuting hackers, more states have more laws against hacking. The number of hackers will diminish as the threat of getting caught increases. Hackers would think twice before trying to get into a system without authorization if they believe they might be caught.

One of the difficulties of catching hackers is realizing they are attacking. They continue to find ways to circumvent the systems put in place to identify attacks. If a hacker is just stealing information, he can easily seem like a normal person. A hacker could break into someone's account and view all the files that person has access to. More security measures should be implemented to recognize such attacks.

Responsibility

Measures must be taken to save money, and preserve privacy and reputations by preventing hackers from penetrating computers. In IT security, the responsibility to secure systems lies with many people: the users, the programmers, the hardware designers, management, and the system administrators.

Users have a responsibility to secure their accounts. The impenetrable walls of a castle are useless if the gate is left open to invaders. They must not share their passwords with anyone, nor should they store them anywhere. Potential hackers are not limited to external people. Someone in the organization could also be a hacker. Internal hackers could easily search through unsecured documents for passwords. External hackers that penetrate the system could find passwords stored on computers and use them to avoid detection. Users must also choose passwords that are difficult to guess, excluding birthdays and names of relatives and pets.

Programmers have a responsibility to do their best to make the software they build secure. Programmers should do their best to secure the systems and programs they build. If a programmer carelessly develops software that can be penetrated, and his carelessness causes security problems for the system the software runs on, the programmer should be held responsible for his negligence.

Hardware designers have the same responsibility as programmers. They contribute to the construction of the impenetrable wall.

Management has the responsibility of assuring that clear security policies are developed and followed. Managers need to make sure that the wall is impenetrable and the gate is closed and locked.

System administrators have the responsibility of aiding management by verifying that the security policies are followed by all. They are also responsible for detecting intruders and updating software and hardware as information about security problems arise.

The responsibility for securing a computer system does not lie with one person alone: it lies with all those who use or manage the system. Everyone must do their best to keep the system secure.

Technology and Family History

Technology has had a very strong impact on family history. It has made family history easier and more efficient. The strongest asset technology has brought to family history is the ability to instantly communicate with people from all over the world and share information. The next strongest asset technology has brought is the ability to store vast amounts of information efficiently, and the ability to efficiently retrieve and search that data.

The utilization of technology can be improved. Deciphering the handwriting of other people can be difficult at times, not to mention tedious. Improvements in character recognition software can eliminate the difficulty and tedium. Users of PAF are encouraged to use multiple files to store their ancestral information, which requires switching between files and splitting files makes it difficult to link information between the files. It would be much more convenient to store all the data in one file. It can also be tedious to search through all the different databases and gather all the information on one's ancestors. In some databases, such work is inevitable. In other databases, the data is already organized into pedigrees. Increased convenience can be achieved if all the ancestors of a particular person can be downloaded into PAF with the click of a button.

Unlocked iPhones: Round 2

Find updated information about unlocked iPhones at InfoWorld: http://www.infoworld.com/article/07/09/27/New-update-breaks-hacked-iPhones_1.html

Apple is not guilty of any wrong-doing. Apple can do as it pleases if it doesn't violate its part of the service agreement. If you maintain the functionality of your iPhone by disabling automatic updates, you won't get the security fixes and your iPhone will be vulnerable to attack. Unlocked iPhones are ineligible for repair or replacement under warranty because the phone was modified to alter functionality.

It's worthless to unlock an iPhone. Unlocked iPhone owners can expect a long period of conflict with service outages as Apple and the hackers continue to battle with each other. It's worthless to suffer through the outages for slightly better customer service and a phone with a nifty interface.

In other news, LG has released a phone with a large touchscreen that works exclusively with Verizon. I would buy LG's phone, but I'm happy paying less than twenty dollars a month for a reliable pager.

News on LG's phone: http://www.infosyncworld.com/news/n/8405.html
Hackers fight back: http://www.theregister.co.uk/2007/10/03/iphone_update_response/

Deadly Defects

Engineers should make sure that everything they design and build does not have deadly defects. For example, a fuel system control processor with a deadly defect was on Flight 143 in 1983. The plane ran out of fuel before reaching its destination. Thankfully, the plane landed without killing anyone. Humans need help to accurately measure how much fuel is in the tanks, and that help must be trusted to give an accurate measurement so enough fuel is in the tanks for the plane to reach its destination. There are stories of a deadly defect in dialysis machines. Instead of moving the blood of the user through the machine and cleaning it, the machine would start cleaning itself and kill the user as it pumps solvent through the user's body. It is imperative that engineers eliminate deadly defects.

Technology and the Church

Technology has been a great help to the Church of Jesus Christ of Latter-day Saints, and it will continue to be a great help to the Church. Many people misunderstand and are frustrated with the speed that the Church is moving at in utilizing technology. But the cautious rate of change is wise to make sure everything is in order because moving too quickly could cause more problems than would be solved. There are problems with the software that the Church produces, but these problems are gradually being solved. It isn't unusual for software to have bugs. Perfectly bug-free software is nearly impossible to come by. Maybe there are more bugs in the Church's software than other programs, but would it be wise to spend the money to hire the quantity and quality of developers that it would take to improve the software? I don't think so. Software is a nice tool that can greatly help, but it would be unwise to invest money into something that merely supplements the mission of the Church as if it were critical to the Church's mission. The Gospel can be spread without technology. Temple work could be done without technology if needs be, and perfecting the Saints doesn't require technology either. But these missions can be aided by technology. It makes sense to me that the money should be focused more on the critical aspects of the Church's mission than the supplements that aid the accomplishment of the critical aspects.

Unlocked iPhones

Recently, an article was published on Wired about unlocked iPhones. You can read it here: http://www.wired.com/gadgets/mods/news/2007/09/unlocked_iphones

In the service agreement to buy an iPhone, there doesn't seem to be anything against reverse-engineering the phone, using the phone with other networks, or reselling the phone to other people. The hackers don't seem to be doing anything wrong (although I wouldn't consider my observations as authoritative: I have misinterpreted legal documents before). If the hackers cancel service between fourteen and thirty days after getting it, they do not have to pay the early termination fee and they have to keep the phone. Only the initial cost is more for an unlocked iPhone. The hackers will charge enough to recover the costs of the activation fees for AT&T and the cost of buying the phone plus any additional profit they make in auctioning the unlocked iPhone on eBay. If you want an unlocked iPhone, not only do you have to buy an unlocked phone (if you are unwilling to unlock it yourself), you have to pay the activation fees along with any other fees associated with connecting to a different network with an existing phone. Is the cost difference between a normal iPhone and an unlocked iPhone worth the marginal benefit of a "better" phone company?

The Effects of Technology on Society

I don't think technology has made people worse or better. I think technology helps expose the true character of all individuals. It has given a chance for those who would have remained in poverty to realize what they can become and become it. It shows the true character of individuals as information flows around the world about what people do with their time and about what decisions they make. Those who rise to the occasion rise, and those who don't rise to the occasion don't fail because they don't realize there is an occasion (as is the case in many instances without technology) but because they they don't want rise to it.

I'm not saying people cannot change, I'm saying that technology doesn't change people. Only one can change one's self.