Monday, 3 October 2016

Learn CSS in less than 5 mins

Intro

Note: Skip to start here if you just want to start learning CSS.
Developing anything for the web is unnecessarily harder and more complicated than it ever needed to be. The three main web technologies—HTML, JavaScript, CSS— are a little of a kludge that has been put together to let people develop for the web. I have had to learn all three while recently developing a website for the first time. HTML describes the contents of the page, i.e. what was written; JavaScript describes how it behaves when you interact with it; finally, CSS describes how it looks, the font size, when text is bold, etc. It means that there are three technologies one needs to learn before they can begin to be productive. The following is enough to be very productive with using CSS, one of the three main web technologies, within just a few minutes. It requires a background of very basic HTML.

Start here

There are two steps to CSS: selecting the content, then applying the style. CSS is usually added inline between the <style> and </style> start and end tags in the <head> section of the HTML or as an external document in a link: <link href="path/to/file.css" rel="stylesheet" type="text/css" />.

What is CSS

CSS content looks like this:
selector {
    key: value;
    other-key: other-value;
}

Selecting

There are three important ways to select. Given a tag like the following:
<div class="class-name other-class-name" id="id-name">Content</div> there are three different ways to select the content in the tag: by tag, class, and id. The tag name is div, the id name is id-name; and, there are two classes class-name and other-class-name. In the CSS code, the tag name is referred to by just using the name of the tag and the id and class are referred to by prefixing the name of the id and class with "#" and with ".". So although redundant, the following selects the div tag using these three methods.

div #id-name .class-name {
    //CSS stuff goes here.
}


Applying

In essence it is a long list of key->value pairs tied to a selector. The key is the property being changed and the value to which you want to change it. To figure out what the names of all these things are.. just Google it. That's it. You will almost certainly get the result you want first, usually something on the W3 Schools website. An example to make text bold.
That's it! You now know all you need to use CSS to implement anything you want/need on your website.

Saturday, 11 June 2016

Are Unicode characters in passwords really useful?

Unicode characters are supposed increase the difficulty of guessing passwords. The reasoning is that they expand the search space for passwords from the 62 possible alpha-numeric characters up to 1,114,112 total possibilities for each Unicode character.

Doing the maths

Let's assume that we're using upper and lower case ASCII passwords (52 possibilities per character) vs. Unicode. According to Wikipedia: Unicode defines a codespace of 1,114,112 code points in the range 0hex to 10FFFFhex. Let's say that about 100 of them are special control characters that can't be used, leaving 1,114,012.
ASCII ==> 52 characters. (upper and lower case)
Unicode ===> 1114012 --> log52(1,114,012) = 3.5238
i.e. Every random Unicode character has as much entropy as ~3.5 random ASCII characters.
...I hope that's correct.

Side note about passphrases

There are only about 10,000 or so English words that people regularly use. That makes every word not 52n bits of entropy for n characters but one token from a pool of 10,000. Every word gives you an equivalent of using 2.33 random letters. If the number is 100,000 each word then gives you 2.91 random letters per word. I like to think I'm a smart guy, but I'm certain that I don't know anywhere near 100,000 words.

Just type out the Unicode character code

Here is an idea. When you use a Unicode character you need to type out the decimal/hex code. If we allow for all upper+lower+numerical characters it gives 62 bits per character, but when you are pressing each key to input the Unicode character you're only adding 16 bits per key-press. You have to remember and type the hex characters anyway.
e.g. If you want your password to be "m💩nkey" (If that didn't work for you it's "monkey" with the 'o' replaced with a pile of poop.) you need to type this sequence of letters: "m 1 F 4 A 9 n k e y". (I think in Windows you press Alt+ the decimal rather than hex characters, but it really doesn't matter.) That pile of poop added 1,114,012 bits of entropy (let's not assume that a brute force is going to prioritise poop over other possible Unicode characters). If you typed out the characters "1F4A9" to your password, assuming 62 possibilities per character, you would have added 916,132,832 bits of entropy. Especially if for whatever reason Unicode is not allowed in passwords it seems to me that there would be no harm in just typing out the characters if you are otherwise going to force yourself to remember a hex string.