Vince Vielhaber <vev(at)michvhf(dot)com> writes:
> By knowing what PG will do with the username and random salt, sniffing
> the wire can make guessing the password trivial.
Not if the wire protocol is done correctly, ie, passwords are only
sent in hashed form.
regards, tom lane