[38494] in bugtraq
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords
daemon@ATHENA.MIT.EDU (Joshua D. Drake)
Thu Apr 21 13:58:31 2005
Message-ID: <4267D9D7.1010500@commandprompt.com>
Date: Thu, 21 Apr 2005 09:50:31 -0700
From: "Joshua D. Drake" <jd@commandprompt.com>
MIME-Version: 1.0
To: "Jim C. Nasby" <decibel@decibel.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>,
pgsql-hackers@postgresql.org, bugtraq@securityfocus.com
In-Reply-To: <20050420212323.GT58835@decibel.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
> Simply put, MD5 is no longer strong enough for protecting secrets. It's
> just too easy to brute-force. SHA1 is ok for now, but it's days are
> numbered as well. I think it would be good to alter SHA1 (or something
> stronger) as an alternative to MD5, and I see no reason not to use a
> random salt instead of username.
If you aren't paying close enough attention to your database server to
see that someone is trying to brute force your MD5 password you have
bigger problems.
Sincerely,
Joshua D. Drake
--
Your PostgreSQL solutions company - Command Prompt, Inc. 1.800.492.2240
PostgreSQL Replication, Consulting, Custom Programming, 24x7 support
Managed Services, Shared and Dedication Hosting
Co-Authors: plPHP, plPerlNG - http://www.commandprompt.com/
