| From: | Tino Wildenhain <tino(at)wildenhain(dot)de> |
|---|---|
| To: | "Jim C(dot) Nasby" <decibel(at)decibel(dot)org> |
| Cc: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Stephen Frost <sfrost(at)snowman(dot)net>, pgsql-hackers(at)postgresql(dot)org, bugtraq(at)securityfocus(dot)com |
| Subject: | Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted |
| Date: | 2005-04-21 09:06:37 |
| Message-ID: | 1114074398.10488.3.camel@sabrina.peacock.de |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Am Mittwoch, den 20.04.2005, 16:23 -0500 schrieb Jim C. Nasby:
> On Wed, Apr 20, 2005 at 05:03:18PM -0400, Tom Lane wrote:
...
> Simply put, MD5 is no longer strong enough for protecting secrets. It's
> just too easy to brute-force. SHA1 is ok for now, but it's days are
> numbered as well. I think it would be good to alter SHA1 (or something
> stronger) as an alternative to MD5, and I see no reason not to use a
> random salt instead of username.
I wonder where you want to store that random salt and how this would add
to the security.
--
Tino Wildenhain <tino(at)wildenhain(dot)de>
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Mike Rylander | 2005-04-21 11:23:44 | Re: [COMMITTERS] pgsql: Install some slightly realistic cost estimation |
| Previous Message | Simon Riggs | 2005-04-21 07:11:25 | Re: WAL/PITR additional items |