search

mozilla-services / tigerblood

Deprecated, use https://github.com/mozilla-services/iprepd
15 stars 2 forks source link

bloom filter on hawk nonces could reject valid requests as false positives #32

Open g-k opened 7 years ago

g-k commented 7 years ago

Could switch to an LRU cache like: https://github.com/mozilla-services/autograph/blob/master/authorize.go#L80

or have clients generate a new nonce and retry.

autrilla commented 7 years ago

go-syncstorage uses a bloom filter too, and as long as we get less than 2000 rps per node, we're not going to have any collissions, and even if we dip higher than that the probability is going to be very low.

cc @mostlygeek

g-k commented 7 years ago

Yeah, just making an issue to document this since ulfr brought it up, but I don't think we need to do anything for this.

We could always increase the bloom filter size too.

mostlygeek commented 7 years ago

I use two bloom filters so it's easy reset/expire them.

For about 5.6MB of RAM the go-sync implementation can handle about 10,000 req/second. I've seen some nonce collisions with the go-sync. Though I think it is a bug on the FF side since the hashed values are 64bit hashes...