samedi 5 décembre 2015

How a rate button can actually improve your mobile app rating

When I decided to redesign my Android Spirit Level this summer, I was wondering wether or not I should add a "Rate" button to invite users to rate the Bubble Level application.


Get it on Google Play

What I was expecting was more feature requests and a better user feadback. I was also concern about how such a button could annoy users... In the long term, would it lead to a better user rating or a lower user rating ? Here is the answer :

Evolution of the app overall rating
Since the update of late august that added the rate button in the app, overall rating of the app increased faster than before... User feedback was also better because of the easy way to provide it when you see something wrong, something missing or something to improove. In the contrary, number of rates per month does not increase as expected :

Rates per month per value and average rating

I'm not sure wether or not this stat reflect rate that get updated by users... But to provide you with more stats, the rate button has a click to rate rate ;-) of 1 generated rate out of 16 clicks... which is quite low but sufficient to increase the overall rating of the app.

mercredi 29 avril 2015

Certificat based client authentication with apache server

This post describe how to create and use a custom certification authority to generate client certificate that will later be used to authenticate users against apache mod_ssl and pass the credential to the underlying server that processes the client requests : Tomcat, JBOSS or anything else... Apache mod_ssl will be configured to use client certificat based strong authentication that only accept requests that comes from clients presenting a certificat signed by a trusted authority.

Creating the certificates

Certification authority

The first step is to generate our own certification authority certificate. This will be done using standard openssl command to generate a RSA key stored under ca.key. This key will be used to generate a self signed certificate under ca.crt :
ca.key
The RSA key of our own authority
ca.crt
The self signed certificate associated with our authority
ca.public.key
The public key of our authority

Server certificate

The server certificate will be used by the server and presented to the client. It will be signed by the certification authority certificate created above. During the certificate signing request, we'll be asked for a Distinguished Name (DN) or Common Name (CN). The value of that field MUST match the ServerName used in the Apache httpd.conf configuration file. The generation of an unprotected key will allow apache to start without the prompt of a passphrase... which might be useful in some cases.

Client certificate

The client certificate is generated like the server certificate. Each client will have its own certificate that uniquely identifies him. It will be signed by the same certification authority. during the creation of the X.509 client certificat, you'll be prompted for Subject informations. Those informations will be used as credentials to authenticate the user on the underlying server that actually processes the request.

Apache server configuration

The Apache server will be configured to only accept requests that comes from clients presenting a client certificate that is signed by our own certification authority. This is done in the httpd.conf by using those directives in the dedicated SSL VirtualHost :

SSLVerifyClient
The require value force the client to provide its own X.509 certificate during the SSL handshake.
SSLVerifyDepth
Specifies the minimum depth that will be scanned by the server to check for trusted certification authority in the client certificate. A value of 0 will only allow self signed certificates. A value of 1 will accept both self signed certificates and certificates signed by an authority known by the server. In our case, we will use a value of 2 that will only accept certificates signed by an authority known by the server.
SSLCACertificateFile
Specifies the trusted certification authorities.
Thus, only the requests signed by our clients will be authorized.
Fork me on GitHub