Re: Password complexity/history - credcheck?

On 23/06/2024 01:23, Tom Lane wrote:

> Don't suppose it would help to push back on whether your security
> team knows what they're doing.
> ...
> Anyway, considerations like these are why there's not features
> of this sort in community PG. You can use an extension that
> applies some checks, but there's no good way around the "needs
> cleartext password" problem for that.
>
> regards, tom lane

I believe that our security team is getting most of this from our
auditors, who seem convinced that minimal complexity, password history
etc are the way to go despite the fact that, as you say, server-side
password checks can't really be implemented when the database receives a
hash rather than a clear text password and password minimal complexity
etc is not perhaps considered the gold standard it once was.

In fact, I think they see a hashed password as a disadvantage.

credcheck seems to satisfy their requirements - password complexity,
password history, etc but - and this is the crucial bit - only on
cleartext passwords.

If I'm forced to go to cleartext passwords, which would be a nightmare,
credcheck might be worth looking at, but I'm not sure whether or not it
is well adopted, reliable, and without significant issues. I only heard
about it a few days ago from a friend/colleague, so I was wondering if
anybody else was using it and what experiences with it might be.

Regards,

Martin.

--
Martin Goodson.

"Have you thought up some clever plan, Doctor?"
"Yes, Jamie, I believe I have."
"What're you going to do?"
"Bung a rock at it."