[38495] in bugtraq
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted
daemon@ATHENA.MIT.EDU (Tino Wildenhain)
Thu Apr 21 14:11:43 2005
From: Tino Wildenhain <tino@wildenhain.de>
To: "Jim C. Nasby" <decibel@decibel.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>,
pgsql-hackers@postgresql.org, bugtraq@securityfocus.com
In-Reply-To: <20050420212323.GT58835@decibel.org>
Content-Type: text/plain
Date: Thu, 21 Apr 2005 11:06:37 +0200
Message-Id: <1114074398.10488.3.camel@sabrina.peacock.de>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Am Mittwoch, den 20.04.2005, 16:23 -0500 schrieb Jim C. Nasby:
> On Wed, Apr 20, 2005 at 05:03:18PM -0400, Tom Lane wrote:
...
> Simply put, MD5 is no longer strong enough for protecting secrets. It's
> just too easy to brute-force. SHA1 is ok for now, but it's days are
> numbered as well. I think it would be good to alter SHA1 (or something
> stronger) as an alternative to MD5, and I see no reason not to use a
> random salt instead of username.
I wonder where you want to store that random salt and how this would add
to the security.
--
Tino Wildenhain <tino@wildenhain.de>
