THE CRYPTO QUIZ CAFE'S CRYPTIC "CHRISTMAS" QUIZ
First completed hacked by: Squeamish Ossifrage
First completed hacked by: Squeamish Ossifrage
This most magical time of year wouldn't be the same without our favourite Christmas songs. So how about testing your music knowledge with this quiz? Inside you'll find clips of the word "Christmas" from 50 Christmas songs to identify. That's not quite true though. Of course, there's loads of Christmas songs, but many don't have the word "Christmas" in their lyrics. Classics, such as Johnny Mathis' "When a Child is Born", Jimmy Durante's "Frosty the Snowman" and "Peace on Earth / Little Drummer Boy" by Bing Crosby and David Bowie (such a bizarre pairing at the time!) were all excluded. Instead, there's a surprising amount of songs with the word "Christmas" in their lyrics that aren't Christmas songs and some are in this quiz. Just thought I'd warn you.
It's a tough quiz with songs from many genres spanning several decades, so a few hints won't hurt. Inside you'll find a Nigerian-born British soul singer, two Bond theme singers, a new-wave band from Ohio, one song from a rock opera and one from a rock mockumentary, two versions of the same song, three anti-war songs, one song about a premature baby and one song about a heart-breaking abortion. Not all Christmas cheer - but perhaps a reminder that Christmas isn't just a time to celebrate but also an opportunity to reflect upon some of the problems we faced during the past year and to consider those less fortunate than ourselves.
Click on the numbered tabs above to start the quiz. Green button to listen to the clip. Enter your guess for the artist and song. Red button to check your answer.
Note that your browser might mark this site as insecure. That's because it doesn't have a certificate - something that websites use to allow your browser to confirm that the website is authentic and then to enable encrypted communication between your browser and the website. Essential for when you need to communicate sensitive information such as for banking, but not really for a quiz such as this as nothing you enter gets sent back to the server.
If you're wondering what all this has to do with “crypto” (cryptography or cryptology), then read on. If you're a cryptographer/hacker/programmer or just inquisitive, then there's a fair chance you'll have figured out the answer to that before you've read this. But first, a little more help: punctuation is important. You'll find all of the following characters at least once somewhere in the answers:
! ? ’ ( )
Case, however doesn’t matter. Nor do accents as they’re hard to type on an English keyboard – so if one of the answers just happened to include an “é”, just type “e” instead. One final hint - you've heard of "The Arctic Monkeys"? Wrong, they're just "Arctic Monkeys". They're not in this quiz, but that's still a hint.
Next, I need to explain a little about how this website came about. I’d had the idea for several years but didn’t have the skills to build a website. I recently found myself with a little free time and decided to change that and learn HTML, CSS & JavaScript – the three languages needed to build pretty and interactive websites. HTML is the language that tells your browser what to display – like this text and the pictures. CSS tells your browser how to display things – like fonts and colours. JavaScript is programming language that, amongst other things, allows you to interact with the web page – like clicking the buttons in this quiz.
All three of these languages are stored in files on a server somewhere on the Internet and downloaded onto your computer/phone to be processed by your browser. This is known as “client-side” processing. So, what’s to stop a website from downloading some malicious JavaScript to your browser? There’s several mechanisms in place to protect you and I’d like to mention two: firstly, your browser isolates any JavaScript it runs from the rest of your computer – so it can’t, for example, read your private files. If it does need access to something on your device such as GPS location or your camera, your browser should first ask for your permission. Secondly, you can see all the raw HTML, CSS & JavaScript used to generate each page if you know where to look. Admittedly not much use if you’re not a programmer, but at least it allows some of those that are to earn a living protecting the rest of us.
Now I was armed with all the tools needed to build this website I gave myself a two-month deadline – to launch at the start of December 2018. One snag though – how to check whether your guesses are correct? The simple way would be to include the correct answers in the JavaScript – as they wouldn’t appear on the screen - and use some other JavaScript to compare it to what you’ve typed. Of course, as I just explained above, the correct answers would be easily visible to prying eyes, so I had to find an alternative.
The standard approach to a problem like this is to resort to “server-side” processing; store the answers securely on the server and send the guesses entered into the browser back to the server to be checked (processed). Server-side processing is very common on modern websites – visit an on-line store and the server will construct its home page on demand before sending it to you – this allows it to customise content for each visitor. When you buy something, the server likely does a whole load of things like checking stock and processing your payment. So, now I knew I had to learn server-side processing too.
Or did I? I’ve an interest in cryptography and realised it might help to find an alternative solution. But before I discuss how, I want to talk about using passwords to log into a website. When you create a password to register for a website, you send it to the website and it’s stored it in a database so the next time you enter your password, it can be compared and verified. There’s a massive problem with this though (one of many problems with passwords). If the website gets hacked, an attacker gets all the passwords and can impersonate users on that website. Worse still, because many people use the same passwords on multiple websites, the attacker can also attack these. A tip – don’t use the same password for more than one site.
To stop password database theft, most self-respecting websites don’t store passwords any more but instead store a “hash” of the password. A hash is the result of feeding some information, such as a password, into a clever bit of mathematics known as a “hash function”. If you change the input even just slightly, the resulting hash will be completely different. Another key feature of a hash function is that it can’t be reversed. So, calculating the hash of a password is easy, but, given the hash, you can’t easily calculate the password. If the hashes are stolen, the attacker doesn't get the passwords. And next time you log in, the website calculates the hash of the password you submit and compares it to the hash stored in the database. If it matches, you must have entered the correct password.
All good right? Not quite. In the deep, dark depths of the Internet exist vast lists of passwords created initially from standard word dictionaries . These are then extended using stolen password databases. These stolen passwords are then analysed to find patterns in the way people create passwords – such as “banana1972” – and these patterns can then be used to further grow the list of passwords – e.g by adding “banana1973”, “banana1975” etc. Hackers can then calculate the hash of all these millions of passwords – this may take some time, but eventually a hacker has a database of hashes that they can use to lookup a stolen hash and discover its original password. This is known as a “dictionary” attack. Another tip – don’t use passwords that are likely to have been used by someone else before as there's a good chance they'll be in one of these lists.
To slow attackers down further, cryptographers came up with a clever idea know as a “salt”. This is just a little random data that’s added to the password before its hash is calculated so the hash is different than one created without a salt. Each password should use a different salt and the salt can safely be stored by the website along with the hash. When you log in, the same salt is added to the password you enter before calculating its hash which should again match the hash in the database. This slows attackers down because now they must create a hash database for each salt in the stolen data – a much harder challenge in terms of the necessary computing power required. Speaking of computing power, another way to slow attackers down is to feed the hash back through the hash function and repeat several times. Each repetition takes a finite amount of time – not really a problem for a one-off calculation when you log in, but scale that up to millions of calculations and this gives an attacker a real headache when they want to create a hash database. Just to give you some sense of the scale of this headache, the time required to perform these kinds of operations is often measured in “ages of the universe”!
Maybe you’ve now guessed what hashes have to do with this quiz? The hashes of the answers are sent down to your browser and when you make a guess, JavaScript in the page calculates the hash of your guess and compares it to the correct version. Very similar to checking a password except that it’s all done in your browser. It does however make this quiz vulnerable to a dictionary attack and, as the hash & salt database is sent to your browser, there’s no need for an attacker to steal it from this website (and the un-hashed answers don’t exist on the website either!). Also, if you think about it, the dictionary required would be relatively small, so a dictionary attack is probably quite feasible and won’t take the age or the universe to complete! I’ll leave it as an exercise to anyone interested to see if this quiz can be solved this way – I guess that makes this quiz a race between music gurus and hackers? Game on!
We’re not quite done with cryptography yet though. I wanted a reward for getting each answer correct – it’s not much, but if you get both the artist and song correct for a question, a link to iTunes appears. I needed a way to stop someone from looking under the hood and finding the link before getting the question right. Cryptography to the rescue again – this time “encryption”. Simply stated, encryption is some more clever maths that takes some data that you want to make secret and a “key” (typically just a very large number) and outputs a “cyphertext” – your secret data rendered unreadable. To decrypt, you need the correct key. Encryption itself is relatively easy – there’s lots of tried and tested methods. What’s hard however, is getting the key securely to the right person. In the case of this quiz, the cyphertext is the iTunes link and the decryption key is simply the correct answer – so no need for me to somehow get it to you securely. There’s also a reward for being first to get all the answers correct – an email address at which you can contact me and, if you like, I’ll add your name to the top of the quiz. This email address is encrypted using the hash of all the correct answers as the key in case you were wandering.
Anyway, thanks for reading! I hope you enjoyed the quiz and maybe learned a little about cryptography too. By the way, I didn't write the JavaScript that does the hashing or encryption - that's way beyond my capabilities. But one of the great things about JavaScript (and other programming languages) is that there's loads of pre-built building blocks or "libraries" of useful code. See the about page for details of the libraries I used.
