@smorimoto Sorry that such a mess was made of your Enterprise downgrade, I've forwarded the ticket t

@smorimoto Sorry that such a mess was made of your Enterprise downgrade, I've forwarded the ticket to the team who help with executing these along with instructions on what actions they need to take.
As it's currently out of hours for myself I will also follow up with a manager in working hours on Monday so I can see what we can do to hurry this along

ErisaOP•11/11/23, 12:15 AM

I work with the Enterprise support team and will keep myself on the ticket to make sure it's correctly handled

EErisa @smorimoto Sorry that such a mess was made of your Enterprise downgrade, I've fo...

Sora Morimoto•11/11/23, 12:18 AM

Thank you! We were going to do the Enterprise contract again, but to be very honest, we were very cautious because of the ticket. You definitely made me feel positive again!

Sora Morimoto•11/11/23, 12:19 AM

It's probably not a small deal for APAC, especially in Japan, and if it goes well, just hype up your great work! I will definitely sponsor that

jpony•11/11/23, 3:09 PM

Is there a way to ignore the "cancelled" status when a user starts an ajax request but closes the browser before it gets a response? Essentially, I just want the worker script to continue doing what it's doing, and just not send anything back if the user is no longer there

Raiyan•11/11/23, 3:24 PM

what package can I use to encrypt password in workers? does node bcrypt works in workers?

jpony•11/11/23, 3:27 PM

worker scripts have access to some web crypto libraries built in

jpony•11/11/23, 3:27 PM

https://developers.cloudflare.com/workers/runtime-apis/web-crypto/

Web Crypto · Cloudflare Workers docs

The Web Crypto API provides a set of low-level functions for common cryptographic tasks. The Workers Runtime implements the full surface of this API, …

jpony•11/11/23, 3:28 PM

So you could save a SHA-256 hash of their password, and then compare what they enter to the SHA-256 hash you save in a KV

Raiyan•11/11/23, 3:30 PM

should I use SHA-256 for password hashing? ChatGPT -> "SHA-256 is not suitable for securely hashing passwords because it is too fast and does not incorporate additional security measures like salting and iteration."

jpony•11/11/23, 3:34 PM

that's a decision you will have to make on your own

Raiyan•11/11/23, 4:36 PM

there used to be a airtable page where there are tested lists of packages that works with workers, do any of you know the link? I can't find it!

RRaiyan there used to be a airtable page where there are tested lists of packages that w...

Cyb3r-Jak3•11/11/23, 4:57 PM

It got removed because it was unmaintained. I use bycryptjs for passwords with my workers

Raiyan•11/11/23, 4:57 PM

Oh ok, thanks!

Unsmart•11/11/23, 5:01 PM

I also use bcryptjs fastnod

its easiest to get on workers but also interestingly there was some conversation on some laravel thing about how its better than argon2 but I dont know anything about passwords to know whats better really LUL

Unsmart•11/11/23, 5:06 PM

https://github.com/laravel/laravel/pull/6245#issuecomment-1730504804

To summarize, even some of the PHC judges acknowledge that, in order to achieve auth speeds in alignment with UX tolerance studies (500ms to 1 second of auth delay per user), both the Argon2 family and scrypt have to be tuned "downward" so much that they end up being less resistant to offline attack than bcrypt at equivalent auth speeds(!)

Unsmart•11/11/23, 5:20 PM

Im aware of what owasp recommends and im sure the maintainers of laravel are aware also but it seems they have information from people who run phc that argon isnt better unless > 1 second runtime

Unsmart•11/11/23, 5:21 PM

But take that information how you want

any of the options will be fine regardless

Ppetter It's an interesting tweet, but it's also 4 years old. I would guess there are mo...

Unsmart•11/11/23, 5:45 PM

https://twitter.com/jmgosney/status/1508435966234611714 he still seems to argue bcrypt over argon in 2022

Ppetter If it's useful for anyone, I created a argon2 worker a couple of days ago that c...

Steved•11/11/23, 8:47 PM

@Petter That looks really interesting. A concern of mine is that bcrypt.js on workers would be too slow to have decent work factor. Did you do any performance testing with your Argon2 worker? (with the OWASP suggested config for Argon2id - interation count 2, memory 19Mib)
Cloudflare crypto has native support for PBKDF2, so I was considering that too (it's not the OWASP preference, but is mentioned as an alternative).

kian•11/11/23, 8:53 PM

PBKDF2 is currently limited to 100,000 iterations on Workers, fyi

SSteved @Petter That looks really interesting. A concern of mine is that bcrypt.js on wo...

Unsmart•11/11/23, 8:58 PM

A like 12 or 13 cost bcrypt runs in 500ms and is plenty for the cost value

Kkian PBKDF2 is currently limited to 100,000 iterations on Workers, fyi

Steved•11/11/23, 9:36 PM

Argh. Thanks for the info, that's a pretty good argument against PBKDF2 given OSWAP suggests 600,000+.
And thanks @Unsmart | Tech debt yes, 12 or 13 should be fine, and 500ms seems reasonable.

sathoro•11/12/23, 6:22 AM

what's the best way to use fetch with a proxy from a Worker?

sathoro•11/12/23, 6:27 AM

can't find any proxy providers that support a dedicated IP with an API endpoint

bkyerv•11/12/23, 1:20 PM

is there any way to create folders in the dashboard where all workers and pages are listed so to group them by projects?

Bbkyerv is there any way to create folders in the dashboard where all workers and pages ...

Cyb3r-Jak3•11/12/23, 3:27 PM

Unfortunately not

bkyerv•11/12/23, 3:56 PM

is this something in the roadmap? I thought this is something that most people would want to use. or am I being biased? now when I heavily use cloudflare for many small projects I spent a lot of time finding my workers and pages.

Theli•11/12/23, 4:31 PM

You are one pages project and few API calls away from it

Ssathoro what's the best way to use fetch with a proxy from a Worker?

dave•11/12/23, 7:34 PM

you mean like a SOCKS-like proxy service that works with Workers?

Ddave you mean like a SOCKS-like proxy service that works with Workers?

sathoro•11/12/23, 7:34 PM

yeah through HTTPS endpoint that has dedicated IP support

sathoro•11/12/23, 7:34 PM

"that has dedicated IP support" this is the part I can't find

sathoro•11/12/23, 7:34 PM

I already have rotating proxies with HTTPS endpoints

Ssathoro "that has dedicated IP support" this is the part I can't find

dave•11/12/23, 7:34 PM

what's the reasoning behind needing a dedicated IP from a third party? Why not use your own?

Ddave what's the reasoning behind needing a dedicated IP from a third party? Why not u...

sathoro•11/12/23, 7:35 PM

my own IP, from where?

Ssathoro I already have rotating proxies with HTTPS endpoints

dave•11/12/23, 7:35 PM

those work with Workers?

sathoro•11/12/23, 7:35 PM

there is a host that has completely blocked all incoming workers

sathoro•11/12/23, 7:35 PM

and we have lots of users that use that host for an integration

sathoro•11/12/23, 7:35 PM

and they won't work with us

Ddave those work with Workers?

sathoro•11/12/23, 7:35 PM

of course because its a normal HTTPS call

sathoro•11/12/23, 7:35 PM

no proxy config

Ssathoro of course because its a normal HTTPS call

dave•11/12/23, 7:36 PM

huh interesting, could you show an example fetch?

Ddave huh interesting, could you show an example fetch?

sathoro•11/12/23, 7:37 PM

const params = {
  url,
};

const queryString = new URLSearchParams(params).toString();

fetch(`https://app.scrapingbee.com/api/v1/?${queryString}`);

const params = {
  url,
};

const queryString = new URLSearchParams(params).toString();

fetch(`https://app.scrapingbee.com/api/v1/?${queryString}`);

Ssathoro ```js const params = { url, }; const queryString = new URLSearchParams(params...

dave•11/12/23, 7:37 PM

oh, that ,makes more sense lol. I was thinking it was a straight up standard HTTP proxy

@smorimoto Sorry that such a mess was made of your Enterprise downgrade, I've forwarded the ticket t

Similar Threads