Bugtraq mailing list archives
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords
From: Josh Berkus <josh () agliodbs com>
Date: Wed, 20 Apr 2005 19:18:39 -0700
David, Stephen,
I noted that this was a problem back in August, 2002: http://archives.postgresql.org/pgsql-admin/2002-08/msg00253.php Then, as now, the developers weren't very concerned.
Well, from our perspective, a random salt only protects against a very narrow range of attack types -- ones in which the attacker already has access to the physical database and wants to reverse-engineer user's passwords. We'd be much more interested in the implementation of more/better authentication mechanisms. See follow-up dicussion on pgsql-hackers. Of course, if either of you *wrote* a random-salt patch for PostgreSQL, psql and libpq, then that would be a different story. I don't know that anyone has anything *against* a random salt. It's just not nearly as useful as, for example, implementing SHA1. -- --Josh Josh Berkus Aglio Database Solutions San Francisco
Current thread:
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted, (continued)
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted Rod Taylor (Apr 21)
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted Tino Wildenhain (Apr 21)
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted Michael Samuel (Apr 22)
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords Jim Knoble (Apr 21)
- RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords Mike Fratto (Apr 21)
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords Stephen Frost (Apr 21)
- RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords Mike Fratto (Apr 22)
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords Stephen Frost (Apr 22)
- RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords Mike Fratto (Apr 22)
- Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords Jim Knoble (Apr 22)