The following bug has been logged on the website:
Bug reference: 14586
Logged by: Markus Bräunig
Email address: markus(at)braeunig(dot)biz
PostgreSQL version: 9.6.2
Operating system: CentOS Linux release 7.3.1611
Description:
The option "--write-recovery-conf" of pg_basebackup creates a valid
recovery.conf but misses to apply secure file permissions when the default
format (plain) is used.
If you tar the result (-F t), the recovery.conf inside the base.tar has the
permissions 0600.
In plain format the umask of the actual user is applied and the permissions
are e.g. 0644.
Because plain passwords are possible in this file, I would suggest to unify
this behavior and change the permissions to 0600 in both cases.
Regards
Markus