开发者

What does the "stretches" of database_authenticatable of devise mean?

I see in the config/initializers/devise.rb, there is a configuration called "config.stretches".

# ==> Configuration for :database_authenticatable
# For bcrypt, this is the cost for hashing the password and defaults to 10. If
# using other encryptors, it sets how many times you want the password 开发者_开发技巧re-encrypted.

config.stretches = 10

I don't understand what does the stretches mean. It says it is the times I want the password "re-encrypted". Why and we the password will be re-encrypted? And why I should specify a "times"?


The short answer is that it makes brute force dictionary attacks take longer.

This blog post is written in reasonably plain English, and might give you a better idea of what's going on.


Though @jdl answer has been accepted but it really isn't in a plain English or in the one I'd understand any better. This link helped me better understand about stretches

This will increase performance dramatically if you use bcrypt and create a lot of users (e.g. if you use Factory Bot or Machinist). Key stretching is a method of improving the security of passwords at the expense of speed.

For deeper understanding you can checkout key stretching on wiki

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜