[38490] in bugtraq
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords
daemon@ATHENA.MIT.EDU (Josh Berkus)
Thu Apr 21 13:18:10 2005
From: Josh Berkus <josh@agliodbs.com>
Reply-To: josh@agliodbs.com
To: bugtraq@securityfocus.com
Date: Wed, 20 Apr 2005 19:18:39 -0700
In-Reply-To: <1114002881.20906.ezmlm@securityfocus.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200504201918.39968.josh@agliodbs.com>
David, Stephen,
> I noted that this was a problem back in August, 2002:
>
> http://archives.postgresql.org/pgsql-admin/2002-08/msg00253.php
>
> Then, as now, the developers weren't very concerned.
Well, from our perspective, a random salt only protects against a very narrow
range of attack types -- ones in which the attacker already has access to the
physical database and wants to reverse-engineer user's passwords. We'd be
much more interested in the implementation of more/better authentication
mechanisms. See follow-up dicussion on pgsql-hackers.
Of course, if either of you *wrote* a random-salt patch for PostgreSQL, psql
and libpq, then that would be a different story. I don't know that anyone
has anything *against* a random salt. It's just not nearly as useful as,
for example, implementing SHA1.
--
--Josh
Josh Berkus
Aglio Database Solutions
San Francisco
