My Coding Origin Story

ascii picard

Earlier today Ben Halpern posted a bit about his coding origin story on dev.to. I thought it might be interesting to share how I got my start.

Growing my family was not an early computer adopter. Computers were expensive and my parents were endlessly frugal. So I don’t share the common origin story for a lot of nerds of my generation, I never noodled around with a Commodore 64 or anything of that era.

My first exposure to computer programming was writing simple routines in Logo on an Apple IIe in grade 6. Logo was very simple, but super valuable as a fundamental building block. My experience taught me the basics of looping and the idea of printing things to the screen and it certainly piqued my interest in programming at an early age.

The next code adjacent thing I remember doing was mucking around with the Windows 3.1 autoexec.bat file on my grandfather’s 386 laptop (which he had left with me for some reason), probably circa 1993. Pre-Internet I have no idea how I knew this was a file I could edit, what it did or what to do with it. Perhaps I read the MS-DOS help files. One thing I did learn quickly is that this file had the power to stop Windows from booting. And this actually taught me the important lesson of remaining calm in the face of utter, self-inflicted code disasters.

My coding memory is a huge one. It happened when my family finally got our first PC, a Compaq Presario 486, probably around 1994/95. Again, I don’t recall exactly how, but I soon discovered BBSes and door games. My favourite game by far was Legend of the Red Dragon (playable here). At this same time, I’d started to dive in to qBASIC. I poured through the source code of the demo programs and read through the included documentation. For some reason I decided to attempt to recreate a local version of LORD in qBASIC — except Star Trek: The Next Generation Themed (of course). I built an ASCII interface, ASCII procedural map generator, random encounters and a rudimentary combat system, a town with shops (armour, weapons and potions), system for tracking progress (goal, xp and levels) and that sort of thing. I retrospect, this seems like a monumental task, something I’d never even think to attempt now. With this experience, I had essentially taught myself all the fundamentals of programing I still use today: procedures, variables, control structures, logic, etc.

My first experience with HTML is probably a little more similar to other developers of my generator — Geocities and Netscape circa 1997. I distinctly remember the first website I built on geocities.com, a Star Wars: CCG “bad trader” list — basically a blacklist of people who’d screwed my friend Jon out of cards online — an HTML table on a repeating star background (groundbreaking stuff!). Having worked with the pre-written example programs source code that shipped with qBASIC years prior, the leap to view source on every single website came naturally. And by this time there were already well developed resources for learning HTML online.

I’m actually a little less certain about my introduction to PHP. I think it may have been Movable Type of my first domain (leggomyeggo.net).

Sprinkled here and there is some formal education and the rest — as they say — is history.

SQRL Poised To Save Us From Password Hell

A few times every decade we get to witness the emergence of a truly revolutionary back-end technology breakthrough. I recall following OpenID in the mid-00’s, reading some of the early discussion groups and blog posts, eventually watching it become supplanted by OAuth. Which would go on to drastically simplify the way most people log in to websites. I wonder if we’re witness a moment like that right now with the Simple, Quick, Reliable Login (SQRL) protocol.

SQRL is a decentralized website login and authentication protocol released last week after over half a decade of work, by security researcher Steve Gibson. It is a protocol that functions like a combination of OAuth and a password manager. Like OAuth, it enables a 1 button (or QR code) login process, simply click an “authenticate with sqrl” link and you’re in. Like a password manager, it is an app that lives on your phone, desktop or a browser extension.

Unlike either of those solutions, the process that occurs in the background after you hit “authenticate” and before you’re logged in is where really groundbreaking stuff happens.

SQRL is client-side authentication, meaning an SQRL client (on your phone, as desktop app or maybe a system service in future) negotiates with the server to validate your authentication. Let that sink in for a second… you don’t tell the server who you are or what your password is, the server ostensibly communicates with your phone to figure out who you are. The nuts and bolts of this system are complicated/technical and I’m not actually sure I fully grasp it at this point. But I do know this has the potential to be huge.

A Short List of Benefits

The client-side approach has several unique advantages and eliminates many of the problems with the current username/password schema:

The server does not store your password (zero-proof)
Not only does it not store your password, the server never interacts with your password in any way. We all know websites really suck at keeping your passwords safe and secret and reusing passwords in 2019 is extremely dangerous. With SQRL only the client app has a password (and it’s highly encrypted).

The server does not know who you are
As far as the technical spec goes, the server does not need a username, email address, facebook id, google account, etc to identify you. It only needs are random public key.

In practice, it a website my ask you to provide a username, but because of the pseudonymous nature of SQRL, the site would have no way of knowing that “ohryan” means “guy who write on ohryan.ca” who is also @ohryan on Twitter.

You can’t be tracked
Because SQRL generates unique public keys on a per domain basis, the protocol does not enable cross-site tracking in the same way as something like OAuth does.

Your identity can’t be hacked
A centralized system like a password manager or an OAuth provider lives in the cloud, so there is always a remote possibility of a massive breach exposing your master password on any given service. With SQRL, your identity stays in the client which is in hardware in your pocket, not one central source that every hacker in the universe can target.

It’s open
SQRL is an open standard. Anybody can create a client, with any additional bells, whistles and improvement they want (including addressing some of the security concerns I talk about below). Apple/Windows/Google could add native OS support. The world’s smartest security researcher can all contribute to the project, write server-side implementations, etc, etc.


Some Concerns

In my opinion, based on my understanding of the protocol today, SQRL has one really big problem and a few smaller problems.

Major Concern: No Deauthorization Mechanism

Simply put, if you lose control of your SQRL identity (say your phone is stolen) the protocol has no way to invalidate the authorizations you’ve given to websites with the stolen identity. It has no way to block an attacker from accessing those sites with your stolen identity (assuming the attacker also has access to your phone password and your SQRL client password). The protocol does have a really robust set of mechanisms to retrieve your identity (including something like the bitcoin paper key system), so you will ultimately not lose access to those sites. But the way the protocol is setup, it is only once you access the site with your recovered identity that the site will learn to distrust your old identity.

Unlike Oauth, where a password reset triggers deauthentication across all previously authorized site. With SQRL, you would have to manually visit each authorized site to deauthorize that stolen identity.

So in this way, SQRL actually behaves somewhat like a password manager. If you lose a device that contains access to a 1password library you’d be similarly screwed. To be 100% secure, you would have to manually reset the passwords on all the hundreds of sites you’d stored in your password manager. Fortunately, in both the cases a thief is unlikely to knowledge of your master password. I just feel like this is a real concern that the Gibson dismisses or doesn’t take as seriously as he should.

Minor Concerns

Phishing is sorta trivial

Since SQRL depends on the user being able to scan arbitrary QR codes to gain access to a site. It’s conceivable to imagine a scenario in which a bad actor could impersonate your bank, create a fake SQRL QR code at www.mybankk.com, hope you don’t notice the misspelling and then subsequently ask for your banking info and steal all your money once you’re in.

The thing is, OAuth is vulnerable to this same type of phishing attempt. A creative bad actor could spoof the entire “sign in with google” process and if the user is not paying close attention to domain name, then the user would be clueless about the spoof.

Hell, I bet there are chat logs between me and notian discussing this very thing when OpenID first started bubbling up.

To my knowledge these types of phishing attempts never materialized against OpenID or OAuth (though I could be wrong).

At worst SQRL is no worse than the status quo. At best SQRL clients may be in a unique position to improve this situation (though there idea to harden SQRL against this attack by using IP addresses is a non-starter IMHO, but I won’t get in to that here).

Malicious Clients

Since SQRL is an open standard any random bad actor could create a malicious client to do malicious things, like stealing your password.

The best solution to this problem is to make the “official” the best possible app, such that the poor quality, slapped-together nature of malicious apps will be obvious. Unfortunately, I’m afraid this will require a real development investment and it’s not clear anyone is willing to pick up the tab.

The project has a long way to go to get there, but then again, it’s essentially day one.


New paradigm

This final concern isn’t really a problem with SQRL as a protocol. It’s more that… We’ve had decades of trying to teach mom & pop how to use usernames and passwords safely and it’s really not going very well. Getting them to adopt a brand new paradigm is going to be hard.

Final Thoughts

First of all, if you’re read this far and you haven’t tried it out. Do it now. Grab on of the apps and try logging in to the official forms at https://sqrl.grc.com/. It will blow your mind.

SQRL seems to be the password solution I’ve always wanted. The concept of decentralization seems inherently right and good, it feels like the natural state of the internet. Decentralization by way of having an on your phone store the sensitive data and do the hard computation, just makes, so, much, sense.

It’s hard to say where this technology will end up. I know Gibson is seen as a bit of a fringe wonk in some circles. I’m very interested to see what real security experts have to say, both about the implementation as well as the underlying crypto.

If it’s as good as it seems, this could be huge.

Further Viewing/Reading

Brass & Bass, Strava, FFVPN – The greatest things of all time… This Week…

B-Complex – Beautiful Lies (Riot Jazz Brass Band Cover)

Yeah, yeah, I know jazz band covers are one of those things that high school band nerds get all obsessed with, but whatever! Riot Jazz Brass Band’s cover of this Drum & Bass track is a real earworm (I’m calling this Brass & Bass).

I’ve also become a little obsessed with Brass Bands in general. Honourable mention to Too Many Zooz for starting me down this path.

Strava!

Two cycling related posts in a row? You bet!
I started using Strava when I bought a decent bike in August, I’ve always liked the idea of tracking my day-to-day. I hope that one day this data could be used in the same way that handwritten diaries of the past were used.

The way that Strava adds a gamification level on top of fitness tracking is really working well for me. For example, I signed up for “The Escape Plan” challenge, which gives you a little digital badge for exercising at least 5 times every week for the Month of September. It’s essentially a video game achievement system IRL. I’ve been able to keep it up for 2 week and all the extra exercise is actually having a positive effect on my mental health. It’s incredible.

Strava also tracks your personal best times, broken up by segments. I know that I’m never going to be as fast as some guy who bikes 100km per day on his $5000 bike. But I can always improve my time. So today on my way home from work I tried hard to beat my own records and wouldn’t you know it, I gained 7 achievements! Feels good.

One other kinda “web 2.0” feature worth mentioning is “flybys.” Strava will show you other Strava users you’ve passed on your ride (or run). Kinda neat. Kinda creepy. It’s opt-out.

FireFox VPN

FireFox release their “VPN” (it’s actually a proxy, I don’t fully understand the difference) this week on testpilot.firefox.com. Ironically, it’s only downloable from the US, so I used a free tunnelbear account to download it.

Speed test looks good, this is slightly lower than my ISP’s max but totally acceptable for web browsing.

Also, it looks FireFox is just cobranding Cloudflare Warp, which hopefully means the Warp VPN is launching soon.

Cycling, Javascript and Saving the Planet

A few weeks ago I bought a basic road bike with the intention of cycling to work. And I’m totally hooked! Addicted maybe? I think I finally get it.

My primary reason for biking to work is to level up the amount of exercise I get in every week, but I’m aware that leaving the car at home has some obvious side effects. By burning less gasoline I’m obviously saving some money and I’m keeping some amount of carbon out of the air.

Meanwhile, I’ve been looking for a good practical way to level up my vue.js skills. So I challenged myself to build a simple tool in vue.js to help me quantify just how much CO2 I’m leaving in the tank and how much money I’m leaving in my wallet.

The result biketoworkcalculator.com

It’s a dead simple tool that allows you to roughly calculate CO2 and dollars you save by riding a bike. Check it out for yourself.

I was actually quite surprised that biking only one day per week would save me around $10 in gasoline over the course of a month.


If you’d like to look at the code or correct my math or whatever, it’s up on github: https://github.com/ohryan/biketoworkcalculator

Oh and if you’re in to cycling, follow me on Strava.

Three of the greatest things of all time… this week…

This past week I’ve made three minor tech-adjacent discoveries that have the potential to change my life in small but important ways.

None of these are groundbreaking on their own, but together they’re actually making me a little excited about “tech” again. In sort of a strange way.

Stoop

I’ve always had two related problems with email newsletters. They clutter up my inbox and I never end up reading any of them. Because of this I actively avoid subscribing to newsletters and often unsubscribe to newsletters randomly. Stoop solves this problem in the best way possible.

Stoop in an app for reading newsletter. Like a podcatcher but for text.

Stoop gives you an @stoopinbox.com email address, which you’ll use to sign up for newsletters. It then receives in them like any other email services, except with a UI tailor to newsletter consumption.

It goes a long way to de-clutter your inbox and gives you a distraction free newsletter reading experience.

Get it here →

Kindle Fire Tablet 7th Edition

A couple of years ago my two boys each received Kindle fire tablets as Christmas gifts. As kids do, they promptly forgot them and abandoned them in a pile of clutter.

I’ve been meaning to read more, for years and year. I’ve only been meaning to read more books proper; but also all those Pocket links I stow away and forget about; and those cool newletters everyone is always recommending 😉

Digital reading has always been a bit of a Goldilocks problem for me. Desktop computer screens are too big; iPads are a little big (great for magazines though) and too heavy to hold up in bed for an hour; phone screens are too small and distracting.

Then I remembered the Fire Tablets.

They’re prefect! Roughly the same height, width and most importantly weight as a paperback novel. Battery life is great and screen resolution is acceptable. You can side-load the Google play store and get most apps. But I’m keeping mine limited to reading apps to maintain a distraction free, reading-focused environment.

I’ve been making a conscious effort to pick up the Fire instead of my phone whenever I want to read Google News or that sort of thing.

Its only (minor) shortcoming is speed. The hardware is old and sluggish. Web browsing is a pain, changing context is slow. But flipping and scroll pages is fast enough. And you could almost spin the sluggishness as a positive, since it discourages you from change contexts and helps focus on what you’re currently reading.

Apparently you can still but the Fire 7 →

KOHO

I can assure you this is not an ad! But I do have a referral code ZL5RTDVQ if you end up using this.

I feel a little weird talking about a financial product, so I’m going to keep this a short as possible.

I was chatting with Internet Good Guy Levisan around the time the Apple Card “unboxing” videos started popping out, commenting on how r/latestagecapitalism they were. He mentioned KOHO, on account of it also having a metal card.

KOHO is an app-based prepaid VISA that offers 0.05% cashback on all purchases (2% on some purchases if you pay for “premium”) and has none of the lame fees that you’d expect from a one time used pre-paid visa you might buy as a “gift card.”

It also offers a “virtual” card in the app for online payments. One that you can turn off if your accounts get pwn’d. AFAIK virtual cards have been rare in the Canadian market before now.

Also you can feed the card with Interac E-transfers.

KOHO feels like it might be a way to get some of the benefits of Apple’s Credit card, without burring yourself even deeper into Apple’s ecosystem.

It’s early days but I’m optimistic that this will improve my financial health. Especially since it’s pre-paid only and there is no way to carry a negative balance.

Get it here →


There you have it. Three things that are blowing my mind this week. 🤯🤯🤯

What’s exciting you right now?