bugtraq - Re: Postgres: pg_hba.conf, md5, pg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200504201918.39968.josh@agliodbs.com>
Date: Wed, 20 Apr 2005 19:18:39 -0700
From: Josh Berkus <josh@...iodbs.com>
To: bugtraq@...urityfocus.com
Subject: Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords

David, Stephen,

> I noted that this was a problem back in August, 2002:
>
> http://archives.postgresql.org/pgsql-admin/2002-08/msg00253.php
>
> Then, as now, the developers weren't very concerned.

Well, from our perspective, a random salt only protects against a very narrow 
range of attack types -- ones in which the attacker already has access to the 
physical database and wants to reverse-engineer user's passwords.  We'd be 
much more interested in the implementation of more/better authentication 
mechanisms.   See follow-up dicussion on pgsql-hackers.

Of course, if either of you *wrote* a random-salt patch for PostgreSQL, psql 
and libpq, then that would be a different story.   I don't know that anyone 
has anything *against* a random salt.   It's just not nearly as useful as, 
for example, implementing SHA1.

-- 
--Josh

Josh Berkus
Aglio Database Solutions
San Francisco