From: | "Gene Sokolov" <hook(at)aktrad(dot)ru> |
---|---|
To: | "Bruce Momjian" <maillist(at)candle(dot)pha(dot)pa(dot)us> |
Cc: | <pgsql-hackers(at)postgreSQL(dot)org> |
Subject: | Re: [HACKERS] Updated TODO list |
Date: | 1999-07-14 07:32:57 |
Message-ID: | 02d701becdcb$17ceda40$0d8cdac3@aktrad.ru |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
From: Bruce Momjian <maillist(at)candle(dot)pha(dot)pa(dot)us>
> > Bruce Momjian <maillist(at)candle(dot)pha(dot)pa(dot)us> writes:
> > >> DB admin has no business knowing other's passwords. The current
security
> > >> scheme is seriously flawed.
> >
> > > But it is the db passwords, not the Unix passwords.
> >
> > I think the original point was that some people use the same or related
> > passwords for psql as for their login password.
> >
> > Nonetheless, since we have no equivalent of "passwd" that would let a
> > db user change his db password for himself, it's a little silly to
> > talk about hiding db passwords from the admin who puts them in.
> >
> > If this is a concern, we'd need to add both encrypted storage of
> > passwords and a remote-password-change feature.
>
> Doing the random salt over the wire would still be a problem.
There is absolutely no technical problem with storing hashed passwords and
still sending salted hash over the wire. It was recently discussed in detail
in "Hashing passwords" thread in pgsql-hackers list.
Gene Sokolov
From | Date | Subject | |
---|---|---|---|
Next Message | Ansley, Michael | 1999-07-14 07:48:01 | MAX Query length |
Previous Message | Nuchanach Klinjun | 1999-07-14 07:26:45 | upgrade problem |