The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

    Mastodon

  • Twitter Updates

  • My Flickr Stream

    20140508-Delphi-2007--Project-Options--Cannot-Edit-Application-Title-HelpFile-Icon-Theming20140430-Fiddler-Filter-Actions-Button-Run-Filterset-now20140424-VMware-Fusion-6.0.3.-no-reclaimable
    More Photos

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,854 other subscribers

Archive for 2019

« Previous Entries
Next Entries »

Some links on keystore, encryption and decryption on Android

Posted by jpluimers on 2019/02/06

For my link archive:

 

Basically:

  • storing encrypted data plus IV in preferences is OK
  • store the symmetric encryption key (for instance an AES one) in the keystore for the application
  • likely a salt is also needed, then store the salt with the IV and encrypted data

–jeroen

Presumptions:

  • The keystore of a specific application UUID is only accessible by only that application UUID when the device has been unlocked by the user
  • The keystore saves credentials in a secure way
  • It is OK to save both the encrypted data and associated IV

Approach (plain data is “hashed application PIN”, encrypted data is “encrypted hashed application PIN”:

  1. store a symmetric AES key in the application key store
  2. after entering application PIN:
    1. hash the application PIN
    2. use the hashed application PIN to to enter the application
    3. from the keystore, obtain the symmetric AES key
    4. create a cipher based on the AES key
    5. use the cipher to obtain an IV, and to encrypt the hashed application PIN
    6. store the encrypted hashed application PIN and IV both in the application preferences
  3. when needing to enter the application, present the user to either enter the application PIN again or proof that they can pass the device unlock sequence (using an unlock activity)
    1. if the user provided the application PIN, then:
      1. hash the application PIN
      2. try to enter the application with the hashed application PIN
    2. proved the device unlock, then:
      1. from the preferences, obtain the IV and encrypted hashed application PIN
      2. from the keystore, obtain the symmetric AES key
      3. create a cipher based on the AES key
      4. decrypt the encrypted hashed application PIN using the cipher and the IV into the hashed application PIN
      5. try to enter the application with the hashed application PIN

Posted in Android, Development, Mobile Development, Software Development | Leave a Comment »

The company as a social engine – The Isoblog.

Posted by jpluimers on 2019/02/06

Food for thought about work: [WayBack] The company as a social engine – The Isoblog.

–jeroen

via: [WayBack] The company as a social engine… – Kristian Köhntopp – Google+

Posted in LifeHacker | Leave a Comment »

Delphi Declarations and Statements: Hinting Directives

Posted by jpluimers on 2019/02/06

From [WayBack] Declarations and Statements: Hinting Directives you might remember this:

The ‘hint’ directives platform, deprecated, and library may be appended to any declaration. These directives will produce warnings at compile time. Hint directives can be applied to type declarations, variable declarations, class, interface and structure declarations, field declarations within classes or records, procedure, function and method declarations, and unit declarations.

However, it doesn’t as at least these fail:

type
{ [dcc32 Error] ClassConstUsageConsoleProject.dpr(14): E1030 Invalid compiler directive: 'DEPRECATED' }
  TMyProcedure = procedure() of object deprecated 'do not use TMyProcedure';
{ [dcc32 Error] E1030 Invalid compiler directive: 'DEPRECATED' }
  TMyReference = reference to procedure() deprecated 'do not use TMyReference';

These two helped me though:

This fails too:

type
{ [dcc32 Error] E2029 '=' expected but ';' found }
  TArrayChars = array of Char; deprecated;
{ [dcc32 Error] E2029 ';' expected but identifier 'deprecated' found }
  TArrayChars = array of Char deprecated;

But this is a workaround:

type
  TArrayCharsOld = array of Char;
  TArrayChars = TArrayCharsOld deprecated;

Which works for the procedure types as well:

type
  TMyProcedureOld = procedure() of object;
  TMyProcedure = TMyProcedureOld deprecated 'do not use TMyProcedure';
  TMyReferenceOld = reference to procedure();
  TMyReference = TMyReferenceOld deprecated 'do not use TMyReference';

Bug https://quality.embarcadero.com/browse/RSP-18316

–jeroen

Posted in Delphi, Development, Software Development | 1 Comment »

GitHub – GoogleChromeLabs/ndb: ndb is an improved debugging experience for Node.js, enabled by Chrome DevTools

Posted by jpluimers on 2019/02/05

This looks like ndp is a drop in wrapper for node allowing for in depth debugging: [WayBack] GitHub – GoogleChromeLabs/ndb: ndb is an improved debugging experience for Node.js, enabled by Chrome DevTools

Via: [WayBack] ndb: An Improved Debugging Experience for Node – Adrian Marius Popa – Google+

–jeroen

Posted in Development, JavaScript/ECMAScript, Node.js, Scripting, Software Development | Leave a Comment »

6502 emulation: the ICE, or in-circuit-emulator…

Posted by jpluimers on 2019/02/05

On my list of hardware things to try:

[WayBack] a different take on 6502 emulation: the ICE, or in-circuit-emulator… – mos6502 – Google+

Basically it consists of three parts:

 

–jeroen

 

Posted in 6502, Development, Hardware Development, History, Z80 | Leave a Comment »

keyman/DevDelphiStarterCompileWrapper.pas at master · keymanapp/keyman

Posted by jpluimers on 2019/02/05

Cool: bds.exe -ns -b projectname.dproj will build a project from the command-line.

Should work in Starter Edition (and the now defunct AppMethod).

[WayBack] keyman/DevDelphiStarterCompileWrapper.pas at master · keymanapp/keyman.

Via: [WayBack] Question: is there any chance Embarcadero would reconsider and stop blocking the use of the command line compilers for Starter Edition?I run an open s… – Marc Durdin – Google+

–jeroen

Posted in Delphi, Development, Software Development | Leave a Comment »

Some commands and links from “Praktijk | Windows PE”; Softlink 1807114 – c’t magazine

Posted by jpluimers on 2019/02/04

Downloads: [WayBack] Softlink 1807114 – c’t magazine

Commands (only execute them from within a Windows PE session!):

  1. Sometimes the network does not start, so you can use the wpeutil command to start it: wpeutil initializenetwork; with wpeutil disablefirewall and wpeutil enablefirewall you can manage the firewall.Background information:
  2. Like regular Windows, net use can map shares to drive letters over a wired network connection. There is a small thing with anonymous logon, see the below links for more, and you might need a network driver that is not automatically loaded, see the next section.
    1. [WayBack] samba – Windows 10 PE Unable to map network drive anonymously – Server Fault
    2. [WayBack] WinPE Network Drivers: Initializing and adding drivers | Microsoft Docs
  3. Windows PE can load most drivers through the drvload command; ensure you have unpacked your drivers and the driver directory contains the appropriate  .inf file, then run drvload E:\driver\drivername.inf where E:\driver is where your driver files are.Background information:
  4. The manage-bde -unlock command can unlock a Bitlocker volume. There are various parameters, but the most used combination is manage-bde -unlock C: -password where C: is the drive you want to unlock and -password (or -pw) causes it to prompt for a password.Background information:
  5. To get information which kind of boot was performed (BIOS or UEFI):

    wpeutil updatebootinfo
    regedit

    Then browse toHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control and check the value for PEFirmwareType: when 1, it is BIOS, when 2, it is UEFI.

    or check out

    [WayBack] Boot to UEFI Mode or Legacy BIOS mode | Microsoft Docs and run this small script:

    wpeutil UpdateBootInfo for /f "tokens=2* delims= " %%A in ('reg query HKLM\System\CurrentControlSet\Control /v PEFirmwareType') DO SET Firmware=%%B
    :: Note: delims is a TAB followed by a space.
    if %Firmware%==0x1 echo The PC is booted in BIOS mode.
    if %Firmware%==0x2 echo The PC is booted in UEFI mode.

You can execute compact.exe with the /compactos parameter from both a regular Windows installation as well as from Windows PE. From Windows PE, you need to provide an extra parameter: the drive to check.

Regular Windows:

  • compact.exe /compactos queries if it is enabled
  • compact.exe /compactos:always enables compactOS

Windows PE:

  • Compact.exe /CompactOS:Query /WinDir:E:\Windows

Background information:

–jeroen

Posted in Power User, Windows | Leave a Comment »

If the downloading PDF reports (like bank statements) from the new ABN AMRO on-line banking environment fails: try the old environment

Posted by jpluimers on 2019/02/04

Great set of steps from ABN AMRO to get into the old on-line banking environment that usually works if the new one fails downloading PDF reports:

Note that outages like these are not reported at [Archive.is] Storingen – ABN AMRO – beschikbaarheid.

Related:

–jeroen

Read the rest of this entry »

Posted in LifeHacker, Power User | Leave a Comment »

RawGit is going away: redirect your content before October 2019 (it does disappear after that)

Posted by jpluimers on 2019/02/04

[WayBack] RawGit: RawGit served raw files directly from GitHub with proper Content-Type headers.

This means you have to redirect your existing RawGit links before October 2019, and you cannot add new links on RawGit.

You might want to try alternatives, for instance this one I mentioned in 2017: raw.githack.com – like rawgit.com but supports bitbucket as well and runs on plain nginx.

[WayBack] raw.githack.com:

raw.githack.com serves raw files directly from GitHub, Bitbucket or GitLab with proper Content-Type headers.

There are some other options that RawGit itself mentions:

What you should use instead

The following free services offer fantastic alternatives to some or all of RawGit’s functionality. You may like them even more than RawGit.

RawGit source is still at [WayBack] GitHub – rgrove/rawgit: Served files from raw.githubusercontent.com, but with the correct content types., so if you want to host your own alternative you can.

It means I need to change these pages:

–jeroen

 

Posted in Development, DVCS - Distributed Version Control, gist, GitHub, Power User, rawgit, Source Code Management | Leave a Comment »

‪Dear #lazyweb, can anyone point me to a modern email server setup (just emai…

Posted by jpluimers on 2019/02/01

Summary from [WayBack]‪ Dear #lazyweb, can anyone point me to a modern email server setup (just email) with letsencrypt, some spam filter, multi domain preferably on RHEL/Cent… – Jan Wildeboer – Google+

  • many SMTP servers on the interwebs do not have proper TLS setups, so do not require remote SMTP servers to deliver email with a proper certificate
  • delivering mail via SMTP using STARTTLS with a proper certificate yourself is a good step forward
  • postfix
  • dovecot
  • greylisting (although in practice it does not make much of a difference any more)
  • fail2ban
  • dnsbl (often called rbl)
  • spamassasin
  • rspamd (supports SPF, DKIM and many others)
  • letsencrypt automation can be tough, so here is a small wrapper: [WayBack] GitHub – DrGlitchMX/update-letsencrypt: Tiny script for updating “Let’s Encrypt!” certificates from cron
  • it helps having letsencrypt and the mail server to be on one machine:
    • multidomain let’s encrypt cert that has my webserver name and the mailserver in the Subject Alternative Names field. As both are on the same machine certbot can automatically update it and I just point Postfix and Dovecot to the LE files.
  • Hans-Martin Mosner SMTP as-is is just not suitable for the kind of decentralized mail that you would prefer. You need some mechanism to determine which mail senders to trust and which not. Cryptography is suitable at the MUA level and should be used much more, but at the MTA level, TLS for privacy and SPF(bleh) or DKIM(meh) for sender domain authentication are basically your only weapons -much too weak. The PGP web of trust must be considered a failed experiment – who of your mail contacts uses PGP properly or at all? Ironically the only secure messaging solutions for the masses are centralized.

Things to do:

  • find a proper multi-MX fallback setup guide for postfix

–jeroen

Read the rest of this entry »

Posted in *nix, *nix-tools, Communications Development, Development, Internet protocol suite, postfix, Power User, SMTP | Leave a Comment »

« Previous Entries
Next Entries »