Don't bieleve "Believe me" - the pitfalls of authentication

--- title: Don't bieleve "Believe me" - the pitfalls of authentication tags: Slide, Certificates, Signature, Authentication, Authorization description: View the slide with "Slide Mode". slideOptions: spotlight: enabled: false allottedMinutes: 40 --- 不能相信的相信我之術: 網路連線雙方驗證時，那些意想不到的坑 ===   Don't bieleve "Believe me" the pitfalls of authentication > [name=郭學聰 Hsueh-Tsung Kuo] > [time=Sat, 15 Oct 2022] [color=red] ###### CC BY-SA 4.0 ---  ## Who am I? ![fieliapm](https://www.gravatar.com/avatar/2aef78f04240a6ac9ccd473ba1cbd1e3?size=2048 =384x384) Someone (who?) said: a game programmer should be able to draw cute anime character(?) ----  * A programmer from game company in Taiwan. * Backend (and temporary frontend) engineer. * Usually develop something related to my work in Python, Ruby, ECMAScript, Golang, C#. * ECMAScript hater since **Netscape** is dead. * Built CDN-aware game asset update system. * Business large passenger vehicle driver. :bus: :racing_motorcycle: * Draw cute anime character in spare time. ---  ## Outline ----  4. Introduction * Encrypted data exchanging * Trusted data exchanging 5. Trusted data exchanging * User * Password * One-time password * MFA * OAuth 1/2 * Signature * HMAC * RSA ----  5. Trusted data exchanging * Service * SSL * TLS * Public key certificate * RSA * ECC: ECDSA/EdDSA/Ed25519 * CA * Chain of trust * Peer to peer * Centralized * Distributed ----  6. When trust is broken... * User * Online account recovering * Offline * Server * Cert revoke * CRL * OCSP & OCSP Stapling * The real world - revoking might not work * DV/OV/EV * Client: Chrome/Edge,Firefox,Safari,IE,Android ----  7. Conclusion 8. Resource 9. Q&A ---  ## Introduction ----  ### Encrypted data exchanging * To ensure that only connection peer can understand the content. * Man in the middle could knows they exchange something. * Contents might be guessed. ----  ### Trusted data exchanging * To ensure that the connection target is really the target. ----  ### Trusted data exchanging :hash: "How to know that connection target is really the target?" ---  ## Trusted data exchanging * User * Service * Peer to peer ----  ### User * Password * One-time password * MFA * OAuth 1/2 * Signature ----  #### Password * A secret data used to confirm a user's identity. * Typically a string of characters. * Example: * "qawsedrftgyhujikolp"  ![rinchan](https://stickershop.line-scdn.net/stickershop/v1/sticker/31272487/android/sticker.png) ----  #### One-time password * A password that is valid for only one login session or transaction. * Example: * SMS OTP * e-mail OTP * Security token for online game ----  ##### Security token ![sqex_security_token](https://www.square-enix-games.com/documents/static/images/otp_en/img03.jpg) https://www.square-enix-games.com/en_US/seaccount/otp ----  #### MFA * Multi-factor authentication * Subset: Two-factor authentication. * Successfully presenting two or more pieces of evidence. * Ex: password + one-time code ----  #### OAuth 1/2 * "Open Authorization" * Grant websites or apps access to personal information on other websites without giving private evidence. ![oauth2](https://oauth.net/images/oauth-2-sm.png) https://oauth.net/2/ ----  #### Signature ![digital_signature](https://upload.wikimedia.org/wikipedia/commons/thumb/7/78/Private_key_signing.svg/491px-Private_key_signing.svg.png) https://en.wikipedia.org/wiki/Digital_signature ----  #### Signature * Verify the authenticity of digital data by asymmetric cryptography. * Signer * Calculate hash of digital data. * Encrypt hash using private key. * Verifier * Calculate hash of digital data. * Verify hash using public key. ----  #### Signature * Only specific key owner can produce the content. * Own the specific key indicates who it is. * Suitable for bot :arrow_right: service. * Example: * HMAC * Amazon S3 * RSA * Google Cloud Storage ----  #### Signature * HMAC * Peers share the same key. * RSA * Service provider owns public key. * Service user owns private key. ----  ### Service * SSL/TLS * Handshake by asymmetric cryptography. * Tell client it is genuine and integrity. * By **public key certificate**. * Exchange symmetric key. * Transfer data by symmetric cryptography. ----  #### SSL * Secure Sockets Layer * Introduced by Netscape. * SSL 1.0 2.0 3.0 ----  #### TLS * Transport Layer Security * IETF refines from SSL 3.0 and standardizes it. * TLS 1.0 1.1 1.2 1.3 ----  #### Public key certificate * Identity document with signature. * To prove it and its key are genuine. * Issue * Self-signed * Sign by CA ----  #### Public key certificate * Format * X.509 * ITU standard * The format of public key certificates. * Signature Algorithm * ~~DSA~~ (too weak) * RSA * ECDSA/EdDSA/Ed25519 ----  ##### RSA * Based on modulus & factorization. * Encryption * Encrypt using public key. * Decrypt using private key. * Signature * Sign using private key. * Verify using public key. ----  ##### ECC (Elliptic Curve Cryptography) * Based on modulus & elliptic curve. * Less calculation & memory cost. * Harder to guess. * Implementation: ECDSA/EdDSA/Ed25519 ----  ![elliptic_curve_cryptography](https://www.allaboutcircuits.com/uploads/articles/Curve_Cryptography_fig03.gif) https://www.allaboutcircuits.com/technical-articles/elliptic-curve-cryptography-in-embedded-systems/ ----  #### CA * Certificate Authority * Sign certificate for websites. * The certificate which represents CA is self-signed. * Distribute certificates with browsers. * Browser should be downloaded from trusted origins. ----  ![certificate](https://upload.wikimedia.org/wikipedia/commons/thumb/6/65/PublicKeyCertificateDiagram_It.svg/1018px-PublicKeyCertificateDiagram_It.svg.png =640x453) https://en.wikipedia.org/wiki/Certificate_authority ----  #### Chain of trust * The root certificate tell that ends are genuine. * Clients validate public key from the end entity up to the root certificate. ----  ![chain_of_trust](https://upload.wikimedia.org/wikipedia/commons/thumb/0/02/Chain_Of_Trust.svg/640px-Chain_Of_Trust.svg.png) https://en.wikipedia.org/wiki/Chain_of_trust ----  ### Peer to peer * Centralized * Distributed ----  #### Centralized * Certificate signed by CA * Example: * VPN using certificates signed by CA ----  #### Distributed * Pre-shared key or certificate * Offline acquired * Online acquired * Based on trusted and secured connections. * Example: * Various types of VPN protocols * Blockchain (cryptocurrencies, NFT) * BitTorrent(!?) ---  ## When trust is broken... Case study: https://techcrunch.com/2021/11/15/hpe-aruba-data-breach/ ----  ### User * Online account recovering * Offline ----  #### Online account recovering * Detected * Temporarily deactivate account. * Then wait for account restoring. * Stolen * Call customer service. * The account might be stolen forever. ----  #### Offline * Go to the counter and show your ID card. ----  ### Server * Cert expired * Cert revoke ----  #### Cert revoke * CRL * OCSP * OCSP Stapling ----  ##### CRL * Certificate Revocation List * A black list of certificates published from CA. ----  ##### OCSP * Online Certificate Status Protocol * Send request to obtain the revocation status of an X.509 certificate. * Impact connection performance. * Leak privacy (others know who accessed something). ----  ##### OCSP Stapling * Cache OCSP result and integrate it in TLS handshake. ----  ```sequence client->server: client hello note right of server: valid OCSP response? note right of server: Y -> use cached OCSP response server->CA: N -> OCSP request CA->server: OCSP response server->client: server hello note left of server: certificate/certificate status note left of client: valid certificate? client->server: Y -> complete handshake client->server: N -> abort handshake ``` ----  #### The real world - revoking might not work * Browsers might not ask revocation status from CRL/OCSP. * **Browsers maintain their own certificate revoke list or behavior**.  * To initialize connection faster.  ----  ##### DV/OV/EV * Domain Validation * Control the domain * Organization Validation * Registered organization * Extended Validation * Business detail (accountant, etc) :moneybag: :arrow_right: VIP  ----  ##### Client | Browser | Cert DV | Cert EV | Comment | | ------- | ------- | ------- | ------- | | Chrome/Edge (Windows) | :x: | :x: (?) | always ignored(?) | | Firefox (OCSP on (default)) | :o: | :o: | OneCRL | | Firefox (OCSP off) | :x: | :x: | OneCRL | | Safari | :o: | :o: | :thinking_face: | | Chrome/Edge (MacOS) | :o: | :o: | based on MacOS | | IE | :o: | :o: | very strict | | | Android | :x: | :x: | always ignored | ---  ## Conclusion ----  ### Experience * Authentication is not as strict as you think. * When handling authentication, doubt it first. ----  ### Slogan :hash: {質疑是資安的根本|<big>Doubt is essential to information security</big>} > [name=郭學聰 Hsueh-Tsung Kuo] [time=2022_10_15] [color=red] :notebook: ---  ## Resource ----  ### Reference * How Do Browsers Handle Revoked SSL/TLS Certificates? * https://www.ssl.com/blogs/how-do-browsers-handle-revoked-ssl-tls-certificates/ * No, don't enable revocation checking (19 Apr 2014) * https://www.imperialviolet.org/2014/04/19/revchecking.html * OCSP & CRL 介紹 * http://ijecorp.blogspot.com/2016/01/ocsp-crl.html ---  ## Q&A --- <style> .reveal { background: #FFDFEF; color: black; } .reveal h2, .reveal h3, .reveal h4, .reveal h5, .reveal h6 { color: black; } .reveal code { font-size: 18px !important; line-height: 1.2; } .progress div{ height:14px !important; background: hotpink !important; } // original template .rightpart{ float:right; width:50%; } .leftpart{ margin-right: 50% !important; height:50%; } .reveal section img { background:none; border:none; box-shadow:none; } p.blo { font-size: 50px !important; background:#B6BDBB; border:1px solid silver; display:inline-block; padding:0.5em 0.75em; border-radius: 10px; box-shadow: 5px 5px 5px #666; } p.blo1 { background: #c7c2bb; } p.blo2 { background: #b8c0c8; } p.blo3 { background: #c7cedd; } p.bloT { font-size: 60px !important; background:#B6BDD3; border:1px solid silver; display:inline-block; padding:0.5em 0.75em; border-radius: 8px; box-shadow: 1px 2px 5px #333; } p.bloA { background: #B6BDE3; } p.bloB { background: #E3BDB3; } /*.slide-number{ margin-bottom:10px !important; width:100%; text-align:center; font-size:25px !important; background-color:transparent !important; }*/ iframe.myclass{ width:100px; height:100px; bottom:0; left:0; position:fixed; border:none; z-index:99999; } h1.raw { color: #fff; background-image: linear-gradient(90deg,#f35626,#feab3a); -webkit-background-clip: text; -webkit-text-fill-color: transparent; animation: hue 5s infinite linear; } @keyframes hue { from { filter: hue-rotate(0deg); } to { filter: hue-rotate(360deg); } } .progress{ height:14px !important; } .progress span{ height:14px !important; background: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAAMCAIAAAAs6UAAAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyJpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0xNDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNiAoV2luZG93cykiIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6QUNCQzIyREQ0QjdEMTFFMzlEMDM4Qzc3MEY0NzdGMDgiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6QUNCQzIyREU0QjdEMTFFMzlEMDM4Qzc3MEY0NzdGMDgiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDpBQ0JDMjJEQjRCN0QxMUUzOUQwMzhDNzcwRjQ3N0YwOCIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDpBQ0JDMjJEQzRCN0QxMUUzOUQwMzhDNzcwRjQ3N0YwOCIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PovDFgYAAAAmSURBVHjaYvjPwMAAxjMZmBhA9H8INv4P4TPM/A+m04zBNECAAQBCWQv9SUQpVgAAAABJRU5ErkJggg==") repeat-x !important; } .progress span:after, .progress span.nyancat{ content: ""; background: url('data:image/gif;base64,R0lGODlhIgAVAKIHAL3/9/+Zmf8zmf/MmZmZmf+Z/wAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh/wtYTVAgRGF0YVhNUDw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0xNDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VSZWYjIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtcE1NOk9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDpDMkJBNjY5RTU1NEJFMzExOUM4QUM2MDAwNDQzRERBQyIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDpCREIzOEIzMzRCN0IxMUUzODhEQjgwOTYzMTgyNTE0QiIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpCREIzOEIzMjRCN0IxMUUzODhEQjgwOTYzMTgyNTE0QiIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChXaW5kb3dzKSI+IDx4bXBNTTpEZXJpdmVkRnJvbSBzdFJlZjppbnN0YW5jZUlEPSJ4bXAuaWlkOkM1QkE2NjlFNTU0QkUzMTE5QzhBQzYwMDA0NDNEREFDIiBzdFJlZjpkb2N1bWVudElEPSJ4bXAuZGlkOkMyQkE2NjlFNTU0QkUzMTE5QzhBQzYwMDA0NDNEREFDIi8+IDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY+IDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8+Af/+/fz7+vn49/b19PPy8fDv7u3s6+rp6Ofm5eTj4uHg397d3Nva2djX1tXU09LR0M/OzczLysnIx8bFxMPCwcC/vr28u7q5uLe2tbSzsrGwr66trKuqqainpqWko6KhoJ+enZybmpmYl5aVlJOSkZCPjo2Mi4qJiIeGhYSDgoGAf359fHt6eXh3dnV0c3JxcG9ubWxramloZ2ZlZGNiYWBfXl1cW1pZWFdWVVRTUlFQT05NTEtKSUhHRkVEQ0JBQD8+PTw7Ojk4NzY1NDMyMTAvLi0sKyopKCcmJSQjIiEgHx4dHBsaGRgXFhUUExIREA8ODQwLCgkIBwYFBAMCAQAAIfkECQcABwAsAAAAACIAFQAAA6J4umv+MDpG6zEj682zsRaWFWRpltoHMuJZCCRseis7xG5eDGp93bqCA7f7TFaYoIFAMMwczB5EkTzJllEUttmIGoG5bfPBjDawD7CsJC67uWcv2CRov929C/q2ZpcBbYBmLGk6W1BRY4MUDnMvJEsBAXdlknk2fCeRk2iJliAijpBlEmigjR0plKSgpKWvEUheF4tUZqZID1RHjEe8PsDBBwkAIfkECQcABwAsAAAAACIAFQAAA6B4umv+MDpG6zEj682zsRaWFWRpltoHMuJZCCRseis7xG5eDGp93TqS40XiKSYgTLBgIBAMqE/zmQSaZEzns+jQ9pC/5dQJ0VIv5KMVWxqb36opxHrNvu9ptPfGbmsBbgSAeRdydCdjXWRPchQPh1hNAQF4TpM9NnwukpRyi5chGjqJEoSOIh0plaYsZBKvsCuNjY5ptElgDyFIuj6+vwcJACH5BAkHAAcALAAAAAAiABUAAAOfeLrc/vCZSaudUY7Nu99GxhhcYZ7oyYXiQQ5pIZgzCrYuLMd8MbAiUu802flYGIhwaCAQDKpQ86nUoWqF6dP00wIby572SXE6vyMrlmhuu9GKifWaddvNQAtszXYCxgR/Zy5jYTFeXmSDiIZGdQEBd06QSBQ5e4cEkE9nnZQaG2J4F4MSLx8rkqUSZBeurhlTUqsLsi60DpZxSWBJugcJACH5BAkHAAcALAAAAAAiABUAAAOgeLrc/vCZSaudUY7Nu99GxhhcYZ7oyYXiQQ5pIZgzCrYuLMd8MbAiUu802flYGIhwaCAQDKpQ86nUoWqF6dP00wIby572SXE6vyMrlmhuu9GuifWaddvNwMkZtmY7AWMEgGcKY2ExXl5khFMVc0Z1AQF3TpJShDl8iASST2efloV5JTyJFpgOch8dgW9KZxexshGNLqgLtbW0SXFwvaJfCQAh+QQJBwAHACwAAAAAIgAVAAADoXi63P7wmUmrnVGOzbvfRsYYXGGe6MmF4kEOaSGYMwq2LizHfDGwIlLPNKGZfi6gZmggEAy2iVPZEKZqzakq+1xUFFYe90lxTsHmim6HGpvf3eR7skYJ3PC5tyystc0AboFnVXQ9XFJTZIQOYUYFTQEBeWaSVF4bbCeRk1meBJYSL3WbaReMIxQfHXh6jaYXsbEQni6oaF21ERR7l0ksvA0JACH5BAkHAAcALAAAAAAiABUAAAOeeLrc/vCZSaudUY7Nu99GxhhcYZ7oyYXiQQ5pIZgzCrYuLMfFlA4hTITEMxkIBMOuADwmhzqeM6mashTCXKw2TVKQyKuTRSx2wegnNkyJ1ozpOFiMLqcEU8BZHx6NYW8nVlZefQ1tZgQBAXJIi1eHUTRwi0lhl48QL0sogxaGDhMlUo2gh14fHhcVmnOrrxNqrU9joX21Q0IUElm7DQkAIfkECQcABwAsAAAAACIAFQAAA6J4umv+MDpG6zEj682zsRaWFWRpltoHMuJZCCRseis7xG5eDGp93bqCA7f7TFaYoIFAMMwczB5EkTzJllEUttmIGoG5bfPBjDawD7CsJC67uWcv2CRov929C/q2ZpcBbYBmLGk6W1BRY4MUDnMvJEsBAXdlknk2fCeRk2iJliAijpBlEmigjR0plKSgpKWvEUheF4tUZqZID1RHjEe8PsDBBwkAIfkECQcABwAsAAAAACIAFQAAA6B4umv+MDpG6zEj682zsRaWFWRpltoHMuJZCCRseis7xG5eDGp93TqS40XiKSYgTLBgIBAMqE/zmQSaZEzns+jQ9pC/5dQJ0VIv5KMVWxqb36opxHrNvu9ptPfGbmsBbgSAeRdydCdjXWRPchQPh1hNAQF4TpM9NnwukpRyi5chGjqJEoSOIh0plaYsZBKvsCuNjY5ptElgDyFIuj6+vwcJACH5BAkHAAcALAAAAAAiABUAAAOfeLrc/vCZSaudUY7Nu99GxhhcYZ7oyYXiQQ5pIZgzCrYuLMd8MbAiUu802flYGIhwaCAQDKpQ86nUoWqF6dP00wIby572SXE6vyMrlmhuu9GKifWaddvNQAtszXYCxgR/Zy5jYTFeXmSDiIZGdQEBd06QSBQ5e4cEkE9nnZQaG2J4F4MSLx8rkqUSZBeurhlTUqsLsi60DpZxSWBJugcJACH5BAkHAAcALAAAAAAiABUAAAOgeLrc/vCZSaudUY7Nu99GxhhcYZ7oyYXiQQ5pIZgzCrYuLMd8MbAiUu802flYGIhwaCAQDKpQ86nUoWqF6dP00wIby572SXE6vyMrlmhuu9GuifWaddvNwMkZtmY7AWMEgGcKY2ExXl5khFMVc0Z1AQF3TpJShDl8iASST2efloV5JTyJFpgOch8dgW9KZxexshGNLqgLtbW0SXFwvaJfCQAh+QQJBwAHACwAAAAAIgAVAAADoXi63P7wmUmrnVGOzbvfRsYYXGGe6MmF4kEOaSGYMwq2LizHfDGwIlLPNKGZfi6gZmggEAy2iVPZEKZqzakq+1xUFFYe90lxTsHmim6HGpvf3eR7skYJ3PC5tyystc0AboFnVXQ9XFJTZIQOYUYFTQEBeWaSVF4bbCeRk1meBJYSL3WbaReMIxQfHXh6jaYXsbEQni6oaF21ERR7l0ksvA0JACH5BAkHAAcALAAAAAAiABUAAAOeeLrc/vCZSaudUY7Nu99GxhhcYZ7oyYXiQQ5pIZgzCrYuLMfFlA4hTITEMxkIBMOuADwmhzqeM6mashTCXKw2TVKQyKuTRSx2wegnNkyJ1ozpOFiMLqcEU8BZHx6NYW8nVlZefQ1tZgQBAXJIi1eHUTRwi0lhl48QL0sogxaGDhMlUo2gh14fHhcVmnOrrxNqrU9joX21Q0IUElm7DQkAOw==') !important; width: 34px !important; height: 21px !important; border: none !important; float:right; margin-top:-7px; margin-right:-10px; } </style>

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.