Phosfox

Alex Giang · UCLA Computer Science

Hi, I'm Alex.

I study computer science at UCLA, especially security, web systems, deployment infrastructure, and machine learning evaluation.

Recent projects include llm-password, a local audit for password patterns that ordinary meters miss, and asdf-fox, a lightweight browser-first audit built on zxcvbn-ts. I first deployed AlmostBear on GKE and later brought it back on Render and Neon. Operand is a real-time multiplayer arithmetic game.

Projects Experience & credentials Password lab

Projects

Notes on how these projects were built, including the decisions and failure modes that rarely fit on a one-page resume.

ECE 202C · local semantic security research

llm-password: semantic password audit

View repository

A local experiment for passwords that look complex while still following an obvious human rule. Rather than stopping at surface patterns, it asks whether ordinary cultural knowledge or pattern completion makes the string easy to continue or reconstruct.

What I built

I combined a patched zxcvbn baseline, a cheap structural check, and continuation-probability estimates from local language models. The more expensive stages run only when the earlier checks leave a meaningful gap.

Why it is a semantic audit

Instead of asking a model for one opaque strength score, the estimator uses token-level dynamic programming over plausible continuations. That makes it useful for phrases, associations, and construction rules that a conventional pattern matcher may never name.

One result worth showing

A long numeric sequence scored around 10^23.57 guesses under the zxcvbn baseline, while a continuation estimate assigned it roughly 10^3.34. That contrast shows how an obvious human rule can survive a length-based meter.

Method and limits

A small language model is not a complete attacker model. I treat this as a second opinion for human-generated sequences, phrases, associations, and rules that surface matching misses. It does not replace breach checks, rate limits, MFA, or proper password storage.

The whole pipeline runs locally and exposes its stages, so password-derived text does not have to be sent to an unrelated scoring service.

Browser-first npm package · password security

asdf-fox: low-cost password audit

Try the live demo

asdf-fox is the lightweight counterpart to llm-password. It starts with zxcvbn-ts and applies named, deterministic corrections when a familiar construction is mistaken for generic brute-force text. It is designed for fast, inspectable feedback in browser and npm integrations, without a language-model runtime.

What it adds

I targeted a few concrete zxcvbn gaps: long arithmetic number runs, truncated repeats, and simple character streams interleaved with one another. The package also extends local word and name coverage with current terms that the base dictionaries may not recognize. Each rule is reported as evidence instead of disappearing into an unexplained replacement score.

Parsing repairs

A bounded span that zxcvbn-ts treated as generic text can be rechecked locally for a lower-cost known-word parse. A separate exact lookup catches frequent directional word pairs, with a capped discount that retains the direction and separator costs. Those passes address cases where the pieces are individually visible, but the baseline parse still misses their relation.

Bounded breach checks

Results keep the baseline and adjusted log10 estimates, matched structures, and an A–F grade, where A means acceptable rather than exceptional. The optional Pwned Passwords check performs the SHA-1 range query from the browser and can warn about a few easy breached variants, not only an exact full-password match.

Why this remains distinct from llm-password

asdf-fox stays within inexpensive, testable rules that can be reproduced in a browser or npm integration. llm-password handles the harder cases, where cultural knowledge or continuation reasoning matters but no small deterministic rule explains the weakness well.

Read the source on GitHub · view the npm package

Team web application · GKE → Render + Neon

AlmostBear

Visit almostbear.uk

A location-aware recommendation PWA built with React/TypeScript, Node/Express, and PostgreSQL. The course version ran on Google Kubernetes Engine; after that deployment was archived, I revived the application with the web service on Render and PostgreSQL on Neon. The product includes recommendation history, Leaflet geolocation, offline caching with queued writes, server-sent notifications, and a Gemini fallback.

My scope

I handled most of the deployment work: containerization, runtime debugging, Kubernetes configuration, DNS/HTTPS, and the CI/CD path. When I brought the site back later, I moved the application to Render and the database to Neon. The recommendation UI, login flow, and most product features were shared team work with separate owners.

Original GKE deployment

For the course, two application replicas ran on Google Kubernetes Engine behind HTTPS ingress, with PostgreSQL as a stateful workload. Health probes, resource limits, secure cookies, and a managed certificate were all part of the working deployment rather than a diagram-only plan.

Current home

Keeping a Kubernetes cluster alive for a portfolio demo stopped making sense once the course credits ended. The current version uses Render for the application and Neon for PostgreSQL, which keeps the project available at the same domain with much less infrastructure to maintain.

What changed between deployments

The original rollout hit the kinds of problems that disappear from a polished architecture diagram: a PostgreSQL volume-path issue involving lost+found, an application-to-database connection failure, certificate and DNS delays, and differences between local WSL development and the deployed containers.

I eventually archived the GKE version rather than pay to keep a small cluster running for a class project. Reviving it on Render and Neon was a different kind of deployment decision: less infrastructure, lower cost, and a live project I can still maintain.

Real-time browser game · Fly.io

Operand

Visit operand.uk

A two-player arithmetic race built around shared invite-link rooms. Each match lasts 120 seconds, and a weighted wheel changes the round based on who is ahead. The result has more pressure and more room for a comeback than a plain speed test.

Why it exists

I wanted a mental-math game that remained interesting after one player gets ahead. The wheel mechanic creates a risk/reward event rather than just adding harder arithmetic.

Live-system part

Each room has two players, one timer, shared state, and an invite link that another person can actually open and use. The application is deployed on Fly.io.

Experience and credentials

Scale AI

Technical Advisor Intern

Evaluated model outputs and reviewed mathematical reasoning, programming solutions, and training-task quality. I moved from contributor to trusted reviewer across three projects: open-form math writing, AIME-specific math writing, and competitive-programming solution review involving AtCoder/Codeforces-style problems.

Employee of the Month · December 2025

Credential

AWS Certified Solutions Architect – Associate

The certification gave me a useful framework for deployment decisions. The projects above are where I applied it: containers, managed services, networking, persistence, health checks, TLS, and the failure modes that appear after launch.

Competitive programming

Algorithmic problem solving

I qualified through the UCLA ICPC tryout and use contests to practice moving from a proof idea to a correct implementation under time pressure. My public handle is Phosfox.

How would I get through my own password checkers?

The generator below picks four short, familiar chunks independently, then adds three random digits in one of several punctuation patterns. The result is meant to be rehearsed as a strange little sequence rather than remembered as a sentence.

It runs entirely in your browser. Nothing you generate is sent to this site. The format is designed for accounts where you want a manually entered password you can rehearse.

4independent word chunks
10number attachment styles
~47nominal selection bits
Generating…

Practice view shows the chunk boundaries. In the copied password, the word chunks are joined directly; the number attachment may include punctuation.