Encryption Pitfalls and Workarounds

on YouTube ↗10m

" summary

Compares two Ruby gems: attr_encrypted (flexible, per-record key support) and Cryptkeeper (simpler, single-app key, built-in search). Reports a real deployment with 15,000 users where Cryptkeeper’s plaintext search causes logins to stall; maintainer Joshua Priddle supplies an unsanctioned hash-based lookup workaround that rewrites find_by_email to restore uniqueness and search. Discusses tradeoffs: per-record keys for stronger security, hashing for searchable fields, and added CPU/storage costs when encrypting at scale.

AI-written summary · about

" chapters (10)

1. 0:00Start
2. 1:24How Encryption Works
3. 1:34What is Encryption Anyway?
4. 2:27Example
5. 3:19Considerations
6. 3:49What to encrypt?
7. 4:52Risk Assessment
8. 5:59Tools
9. 6:41crypt_keeper
10. 7:14Issues with Scale

" related talks

• 23mEncrypted Search PartyFiona McCawley · RubyConf AU 2023
• 38mActiveRecord::Encryption; Stop Hackers from...Kylie Stradley, Matthew Langlois · RailsConf 2023
• 34mKrypt the next level of Ruby CryptogaphyMartin Boßlet · RubyConf 2012
• 31mFast, highly effective database security using searchable encryption (without the yak shave)Dan Draper · PyCon AU 2024
• 41mNon-traditional Encryption Problems And SolutionsChuck Willis · Global AppSec Dublin 2023
• 26mAdventures in Paranoia with Sinatra and SequelEleanor McHugh · MountainWest RubyConf 2013
• 34mWhy your encrypted Database isn't secure: practical attacks against encrypted OSS databasesDan Draper · linux.conf.au 2022
• 34mEncrypted Credentials on Rails 5.2: Secrets to SuccessChristopher Rigor · RailsConf 2018