Re: You're on SecurityFocus.com for the cleartext passwords.

on 5/6/00 2:14 PM, Tom Lane at tgl(at)sss(dot)pgh(dot)pa(dot)us wrote:

> However, I still fail to see what it buys us to challenge the frontend
> with two salts. If the password is stored crypted, the *only* thing
> we can validate is that password with the same salt it was stored
> with. It doesn't sound like MD5 changes this at all.

The MD5 definitely doesn't change anything except overall security strength
of the algorithm. The additional random salt prevents someone from sniffing
the communication between client and server and then simply log in by
sending the known hash of the password. The challenge-response means that
sniffing one login doesn't allow you to fake the next one.

-Ben