Re: Client-side password encryption

From: Peter Eisentraut <peter_e(at)gmx(dot)net>
To: pgadmin-hackers(at)postgresql(dot)org
Subject: Re: Client-side password encryption
Date: 2006-01-05 10:45:53
Message-ID: 200601051145.54199.peter_e@gmx.net
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgadmin-hackers

The officially sanctioned function for this is now PQencryptPassword() in
libpq. Please consider using it when available.

I wrote:
> Commands like CREATE USER foo PASSWORD 'bar' transmit the password in
> cleartext and possibly save the password in various client or server
> log files. I have just fixed this for psql and createuser to encrypt
> the password on the client side. A quick check of the pgadmin3 source
> code shows that you are also affected by this issue. I ask you to
> check where you paste cleartext passwords into SQL commands and change
> those to encrypt the password before sending or storing it anywhere.
> The required function pg_md5_encrypt() is contained in libpq.

In response to

Responses

Browse pgadmin-hackers by date

  From Date Subject
Next Message Andreas Pflug 2006-01-05 11:40:24 Re: Client-side password encryption
Previous Message svn 2006-01-04 11:23:20 SVN Commit by dpage: r4869 - trunk/www/pgadmin3/css