pondělí 29. září 2014

Apache httpd 2.4.6 hangs not servicing HTTPS

A lot of pain ... till solution found
# Apparently this fixes an issue with Apache 2.4.6 on Windows hanging
# when serving requests from Internet Explorer 10/11.
# see http://stijndewitt.wordpress.com/2014/01/10/apache-hangs-ie11/
AcceptFilter http none
AcceptFilter https none



neděle 7. září 2014

... Google Authenticator or Doogee DG800 strange error

After purchasing new chinese Android phone I needed to install Google Authenticator. But had no luck. The application worked fine but ... generated codes did not work. I tried other phones and came to a strange conclusion. The other Doogee DG800 I had show she same codes. Bud all other Android phones shown different codes. For sure all the phones shared the same secret.  The strange thing was the codes were different in some digits only. Typical difference looked like this 605678 - 604356.

As the authenticator codes are derived using hash function (RFC 6238 - TOTP), in case of an error there should be completely different results.

Fortunately - authenticator is an open source software. I cloned the repository and built my own version for debugging.

And here is the source of difference. During the computation a piece of a hash value is taken, converted to integer and then divided by a power of 10 and the remainder is the code:

int code =  truncatedHas % (int)Math.pow(10, codeLength);

On the problematic phone the result of power computation was this:
 Math.pow(10, codeLength): 999999,99999999

After cast to integer the result was 999999.

This is the answer - wrong result from system runtime library because the Math.pow function computes doubles which can be not so precise.

It is rare but it happens.

I'm going to  send a patch which does not uses double computation.

UPDATE: Issue was discussed at Stack Overflow. The main cause is a bug in the phone platform library.