bugtraq - Re: [HACKERS] Postgres: pg_hba.conf, md5, pg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 22 Apr 2005 13:33:44 +1000
From: Michael Samuel <michael@...net.net>
To: bugtraq@...urityfocus.com
Subject: Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted

On Thu, 21 Apr 2005 11:32 pm, Rod Taylor wrote:
> On Thu, 2005-04-21 at 11:06 +0200, Tino Wildenhain wrote:
>
> One advantage of a random salt would be that the username can be changed
> without having to reset the password at the same time.

And the main advantage is that if you have an account with the same username 
on another database server, it makes attacks twice as hard. (Assuming those 
two database servers, or their backups are compromised)

Note that salts aren't supposed to be secret (well, no more so than the 
password hash), they just need to be unique.

Of course, if you're going to add a salt (which requires changing the protocol 
and the storage format), you may aswell move away from md5 (which has been 
considered deprecated for quite some time... longer than it's been used in 
PostgreSQL), and move towards something more secure, such as blowfish crypt 
(or an AES adaptation of it?).