<story><title>Migrating to CockroachDB</title><url>https://www.openmymind.net/Migrating-To-CockroachDB/</url></story><parent_chain><item><author>brianpgordon</author><text>&amp;gt; if you want password-authentication, you must configure your cluster to communicate using certificates. You can start each node in &amp;quot;insecure&amp;quot; mode, but then can&amp;#x27;t use password authentication. There&amp;#x27;s a issue about this. Like the people posting there, our network is already secured, so this requirement is just an unnecessary nuisance.&lt;p&gt;Eh, I&amp;#x27;m not sure how I feel about this. Obviously you should secure your network as best you can, but how confident are you really that a bad actor will &lt;i&gt;never&lt;/i&gt; find a foothold anywhere in your network? I think I would advocate for your services to all communicate securely (TLS et al), even internally, and if your database supports mutual client&amp;#x2F;server auth like it sounds like Cockroach does then you should use that as well. Particularly if you&amp;#x27;re depending on at-rest encryption handled transparently by the DBMS to protect your users&amp;#x27; data - that won&amp;#x27;t do you much good if someone can just sniff&amp;#x2F;MITM network traffic and wait until a bunch of your data has been queried.</text></item></parent_chain><comment><author>pc86</author><text>I roll my eyes so hard at people who say &amp;quot;well our network is secured, so it can insecure on the inside&amp;quot; I&amp;#x27;m surprised I don&amp;#x27;t have a repetitive stress injury by now. It shows a shocking lack of foresight and is honestly insanely unprofessional. This is the exact same kind of opinions that lead to just about every major data breach in recent memory.&lt;p&gt;Secure everything, and assume that everything is compromised. Anything less is downright negligent.</text></comment>
<story><title>Migrating to CockroachDB</title><url>https://www.openmymind.net/Migrating-To-CockroachDB/</url></story><parent_chain><item><author>brianpgordon</author><text>&amp;gt; if you want password-authentication, you must configure your cluster to communicate using certificates. You can start each node in &amp;quot;insecure&amp;quot; mode, but then can&amp;#x27;t use password authentication. There&amp;#x27;s a issue about this. Like the people posting there, our network is already secured, so this requirement is just an unnecessary nuisance.&lt;p&gt;Eh, I&amp;#x27;m not sure how I feel about this. Obviously you should secure your network as best you can, but how confident are you really that a bad actor will &lt;i&gt;never&lt;/i&gt; find a foothold anywhere in your network? I think I would advocate for your services to all communicate securely (TLS et al), even internally, and if your database supports mutual client&amp;#x2F;server auth like it sounds like Cockroach does then you should use that as well. Particularly if you&amp;#x27;re depending on at-rest encryption handled transparently by the DBMS to protect your users&amp;#x27; data - that won&amp;#x27;t do you much good if someone can just sniff&amp;#x2F;MITM network traffic and wait until a bunch of your data has been queried.</text></item></parent_chain><comment><author>jupp0r</author><text>I came here to mention this, too. It&amp;#x27;s been shown from numerous leaks that defense in depth is a much more effective approach than simply relying on network security.&lt;p&gt;You mention that query response data can be sniffed by an attacker in case networks are compromised. The much worse scenario is that the passwords themselves can be intercepted, giving attackers full access.</text></comment>