← Extractions

Devise pitfalls and way to tighten security — Rafał Rothenberger at wroclove.rb 2022

Rafał Rothenberger's wroclove.rb 2022 talk examines security pitfalls in Devise: bcrypt's 72-byte password limit leaking peppers, how to fix it with Argon2id or HMAC preprocessing, using devise_token_auth with refresh tokens in HttpOnly cookies for APIs, and preventing enumeration and timing attacks via async jobs and rate limiting. Q&A covered external auth providers like Auth0 and whether the speaker had filed upstream issues.

Model

claude-opus-4-7

Ingestion

da5b91b8

Input tokens

499,306

fresh: 351,550
cached: 141,291
cache write: 6,465

Output tokens

15,554

Duration

248.6s

Roundtrips

Tool calls

Cost

$0.00

Nodes/edges extracted

26 / 47

Read set (nodes/edges)

108 / 2

Nodes (26)

update Rafał Rothenberger person

attrs (empty) → {"role" => "software developer"}

description Conference speaker. → Conference speaker. Software developer at Monterail who describes himself as 'a bit of a security freak'. Delivered '...

short_description Conference speaker. → Software developer and security-minded Ruby engineer at Monterail.

create Monterail company

kind (empty) → company

name (empty) → Monterail

slug (empty) → monterail

attrs (empty) → {"industry" => "software consultancy"}

description (empty) → Software company where Rafał Rothenberger works as a software developer (transcribed as 'Montreal' in the automated t...

short_description (empty) → Polish software house employing Rafał Rothenberger.

update Devise pitfalls and way to tighten security talk

description Talk at wroclove.rb 2022. → Rafał Rothenberger's wroclove.rb 2022 talk about security edge cases in Devise. Covers: (1) bcrypt background — salt ...

short_description Talk at wroclove.rb 2022. → wroclove.rb 2022 talk on Devise security pitfalls, pepper leaks, tokens and enumeration attacks.

update Devise tool

description Popular Rails authentication gem. Has a love-hate reputation: per Ivan Nemytchenko's wroclove.rb 2018 audience survey... → Popular Rails authentication gem for password resets, sessions, registration and user management. Has a love-hate rep...

create bcrypt tool

kind (empty) → tool

name (empty) → bcrypt

slug (empty) → bcrypt

attrs (empty) → {"category" => "library"}

description (empty) → Password-hashing function (not a general hashing function). Takes fixed-size input and produces fixed-size output; mo...

short_description (empty) → Password-hashing function with a fixed 72-byte input limit.

create Argon2 tool

kind (empty) → tool

name (empty) → Argon2

slug (empty) → argon2

attrs (empty) → {"category" => "library"}

description (empty) → Password-hashing function, winner of the 2015 Password Hashing Competition. Argon2id variant recommended by Rafał Rot...

short_description (empty) → Modern password-hashing function, winner of the 2015 PHC.

create devise_token_auth tool

kind (empty) → tool

name (empty) → devise_token_auth

slug (empty) → devise_token_auth

attrs (empty) → {"category" => "library"}

description (empty) → Ruby gem providing opaque-token-based authentication for APIs, built to work alongside Devise so an application can k...

short_description (empty) → Token-based authentication gem complementing Devise for Ruby APIs.

create OWASP resource

kind (empty) → resource

name (empty) → OWASP

slug (empty) → owasp

attrs (empty) → {"type" => "documentation"}

description (empty) → Open Web Application Security Project. Maintains cheat-sheet series and guidance on everything web-application-securi...

short_description (empty) → Open Web Application Security Project — web security resources and cheat sheets.

create Auth0 company

kind (empty) → company

name (empty) → Auth0

slug (empty) → auth0

attrs (empty) → {"industry" => "identity and access management"}

description (empty) → Cloud identity-as-a-service provider mentioned in Q&A as an alternative to Devise. Rafał noted that offloading passwo...

short_description (empty) → Identity-as-a-service provider for authentication and user management.

create Salt concept

kind (empty) → concept

name (empty) → Salt

slug (empty) → salt

attrs (empty) → {"category" => "practice"}

description (empty) → Random string/bytes added to a password before hashing so that two users with the same password produce different has...

short_description (empty) → Random per-password value stored with the hash to prevent rainbow-table attacks.

create Pepper concept

kind (empty) → concept

name (empty) → Pepper

slug (empty) → pepper

attrs (empty) → {"category" => "practice"}

description (empty) → Random element added to the password during hashing that is kept as a secret outside the database (e.g. in applicatio...

short_description (empty) → Secret site-wide value added to passwords and stored outside the database.

create HMAC concept

kind (empty) → concept

name (empty) → HMAC

slug (empty) → hmac

attrs (empty) → {"category" => "pattern"}

description (empty) → Keyed hash construction (e.g. HMAC-SHA256) useful as a preprocessing step for passwords when stuck with bcrypt but wa...

short_description (empty) → Keyed hash construction usable to preprocess passwords with a secret pepper.

create Password Shucking concept

kind (empty) → concept

name (empty) → Password Shucking

slug (empty) → password-shucking

attrs (empty) → {"category" => "pattern"}

description (empty) → Attack on schemes that wrap a plain hash (e.g. SHA-256) inside bcrypt. Attackers use large databases of broken SHA-25...

short_description (empty) → Attack combining plain-hash pre-images with a bcrypt layer to break wrapped hashes.

create Enumeration Attack concept

kind (empty) → concept

name (empty) → Enumeration Attack

slug (empty) → enumeration-attack

attrs (empty) → {"category" => "pattern"}

description (empty) → Attack that lets a third party discover which email addresses or usernames have accounts on a service. Happens on reg...

short_description (empty) → Attack that discovers which accounts exist by observing form responses or timing.

create Timing-Based Enumeration concept

kind (empty) → concept

name (empty) → Timing-Based Enumeration

slug (empty) → timing-based-enumeration

attrs (empty) → {"category" => "pattern"}

description (empty) → Enumeration variant where the attacker measures response-time distributions for known-absent vs. candidate emails. Sy...

short_description (empty) → Using response-time differences to determine whether accounts exist.

create Using external auth providers instead of Devise question

kind (empty) → question

name (empty) → Using external auth providers instead of Devise

slug (empty) → using-external-auth-providers-instead-of-devise

attrs (empty) → {"answer_summary" => "External providers are great — less passwords is always better — but the token/refresh part of ...

description (empty) → Audience question asking about using third-party auth services like Auth0 to handle users and authentication instead ...

short_description (empty) → Q&A: what about services like Auth0 instead of Devise?

create Refresh Tokens in HttpOnly Cookies concept

kind (empty) → concept

name (empty) → Refresh Tokens in HttpOnly Cookies

slug (empty) → refresh-tokens-in-httponly-cookies

attrs (empty) → {"category" => "pattern"}

description (empty) → Pattern for API token auth: store long-lived refresh tokens in cookies rather than localStorage/sessionStorage. Cooki...

short_description (empty) → Storing long-lived refresh tokens in HttpOnly, Secure, SameSite cookies rather than JS storage.

create AES tool

kind (empty) → tool

name (empty) → AES

slug (empty) → aes

attrs (empty) → {"category" => "library"}

description (empty) → Symmetric encryption cipher. Mentioned by Rafał Rothenberger as an alternative to hashing when using a pepper: encryp...

short_description (empty) → Symmetric encryption cipher usable to encrypt passwords with a rotatable pepper.

create Use Argon2id when you need pepper takeaway

kind (empty) → takeaway

name (empty) → Use Argon2id when you need pepper

slug (empty) → use-argon2id-when-you-need-pepper

attrs (empty) → {"type" => "recommendation"}

description (empty) → If pepper is needed or unbounded-length passwords are desired, use Argon2id. It is the 2015 PHC winner, supports salt...

short_description (empty) → For new apps, replace bcrypt with Argon2id to get native salt+pepper support.

create Limit Devise password length to 72 bytes takeaway

kind (empty) → takeaway

name (empty) → Limit Devise password length to 72 bytes

slug (empty) → limit-devise-password-length-to-72-bytes

attrs (empty) → {"type" => "recommendation"}

description (empty) → If you stick with bcrypt in Devise, set the password length limit to 72 bytes (bytes, not characters) so that users d...

short_description (empty) → Align Devise password length with bcrypt's real limit to prevent silent truncation.

create Never store tokens in plain text takeaway

kind (empty) → takeaway

name (empty) → Never store tokens in plain text

slug (empty) → never-store-tokens-in-plain-text

attrs (empty) → {"type" => "recommendation"}

description (empty) → Tokens are passwords: possession of one lets you act as the user. Never store them in plain text; hash them in the da...

short_description (empty) → Treat tokens as passwords — hash them before writing to the database.

create Use devise_token_auth for API tokens takeaway

kind (empty) → takeaway

name (empty) → Use devise_token_auth for API tokens

slug (empty) → use-devise_token_auth-for-api-tokens

attrs (empty) → {"type" => "recommendation"}

description (empty) → For API authentication, prefer devise_token_auth — a simple, popular, secure-by-default opaque-token solution that co...

short_description (empty) → Prefer devise_token_auth over rolling custom token auth or JWTs.

create Keep refresh tokens in HttpOnly Secure SameSite cookies takeaway

kind (empty) → takeaway

name (empty) → Keep refresh tokens in HttpOnly Secure SameSite cookies

slug (empty) → keep-refresh-tokens-in-httponly-secure-samesite-cookies

attrs (empty) → {"type" => "recommendation"}

description (empty) → Store refresh tokens in cookies with HttpOnly (inaccessible to JavaScript), Secure (HTTPS only), SameSite=Strict (sen...

short_description (empty) → Put long-lived refresh tokens in server-controlled cookies, not JS-accessible storage.

create Make existence checks asynchronous to prevent enumeration takeaway

kind (empty) → takeaway

name (empty) → Make existence checks asynchronous to prevent enumeration

slug (empty) → make-existence-checks-asynchronous-to-prevent-enumeration

attrs (empty) → {"type" => "recommendation"}

description (empty) → On registration, password-reset and confirmation forms, do not check account existence synchronously. Schedule a Side...

short_description (empty) → Move registration/reset existence checks into background jobs so timing is constant.

create Rate-limit login forms with a skip path takeaway

kind (empty) → takeaway

name (empty) → Rate-limit login forms with a skip path

slug (empty) → rate-limit-login-forms-with-a-skip-path

attrs (empty) → {"type" => "recommendation"}

description (empty) → Login forms can't easily be made async, so rate-limit them to prevent timing-based enumeration. Limiting by email can...

short_description (empty) → Rate-limit login by email, but provide an easy way to fall back to IP-based limiting.

create Have you reported these issues upstream to Devise? question

kind (empty) → question

name (empty) → Have you reported these issues upstream to Devise?

slug (empty) → have-you-reported-these-issues-upstream-to-devise

attrs (empty) → {"answer_summary" => "He emailed Devise 3 months ago with no reply; plans a fix but notes breaking API changes in sec...

description (empty) → Audience question about whether the speaker filed an issue with the Devise maintainers. Answer: he emailed about the ...

short_description (empty) → Q&A: did you open an issue on the Devise repo?

Edges (47)

update Rafał Rothenberger → authored → Devise pitfalls and way to tighten security

context (empty) → Delivered this talk at wroclove.rb 2022.

create Rafał Rothenberger → attended → wroclove.rb 2022

context (empty) → Speaker at the conference.

relation (empty) → attended

source_node_id (empty) → 93350e8e-015f-44d6-ac36-17096d5c834a

target_node_id (empty) → cfc5cfd3-25a6-46c2-8b5d-626986c71c24

create Rafał Rothenberger → works_at → Monterail

attrs (empty) → {"role" => "software developer"}

context (empty) → Introduced himself as a software developer at Monterail.

relation (empty) → works_at

source_node_id (empty) → 93350e8e-015f-44d6-ac36-17096d5c834a

target_node_id (empty) → bb79602c-33cf-441b-a266-544ea3d8e4f4

update Devise pitfalls and way to tighten security → presented_at → wroclove.rb 2022

context (empty) → Talk delivered at wroclove.rb 2022.

create Devise pitfalls and way to tighten security → about → Devise

context (empty) → Entire talk documents security pitfalls in Devise.

relation (empty) → about