You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "317brian (via GitHub)" <gi...@apache.org> on 2024/02/26 19:52:42 UTC
[PR] docs: update security doc for hashing (druid)
317brian opened a new pull request, #15970:
URL: https://github.com/apache/druid/pull/15970
Update the docs to remove the performance impact for iterations now that we cache iterations
This PR has:
- [x] been self-reviewed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] docs: update security doc for hashing (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 merged PR #15970:
URL: https://github.com/apache/druid/pull/15970
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] docs: update security doc for hashing (druid)
Posted by "kfaraz (via GitHub)" <gi...@apache.org>.
kfaraz commented on code in PR #15970:
URL: https://github.com/apache/druid/pull/15970#discussion_r1503730207
##########
docs/development/extensions-core/druid-basic-security.md:
##########
@@ -165,13 +165,7 @@ Authorizer that requests should be directed to.<br />
##### Credential iterations and API performance
-As noted above, `credentialIterations` determines the number of iterations used to hash a password. A higher number increases security, but costs more in terms of CPU utilization.
-
-This cost affects API performance, including query times. The default setting of 10000 is intentionally high to prevent attackers from using brute force to guess passwords.
-
-You can decrease the number of iterations to speed up API response times, but it may expose your system to dictionary attacks. Therefore, only reduce the number of iterations if your environment fits one of the following conditions:
-- **All** passwords are long and random which make them as safe as a randomly-generated token.
-- You have secured network access to Druid so that no attacker can execute a dictionary attack against it.
+As noted above, `credentialIterations` determines the number of iterations used to hash a password. A higher number increases security. The default setting of 10000 is intentionally high to prevent attackers from using brute force to guess passwords. We recommend that you don't lower this setting. Druid caches up to the last 1000 iterations for an hour to ensure that having a large number of iterations does not meaningfully impact query performance.
Review Comment:
```suggestion
As noted above, the value of `credentialIterations` determines the number of iterations used to hash a password. A higher number of iterations increases security. The default value of 10,000 is intentionally high to prevent attackers from using brute force to guess passwords. We recommend that you don't lower this value. Druid caches the hash of up to 1000 passwords used in the last hour to ensure that having a large number of iterations does not meaningfully impact query performance.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org