Re: PATCH: warn about, and deprecate, clear text passwords

Guillaume Lelarge <guillaume(dot)lelarge(at)dalibo(dot)com> wrote:

I'm obviously +1 on this patch since I sent kinda the same patch two weeks
> ago

Ha ha, my brain forgot about that one (even though I commented on it!) -
apologies for that.

> set password_encryption to 'md5';
> create user u4 password 'md5u1';
> ...

It complains that I'm using a plain text password and a MD5-encrypted
> password. Can't be both. (Probably not an issue with this patch, but rather
> an issue with the commit that implemented MD5-password warnings.)
>

This is correct - it can be both. Not only are we sending a password in
clear text, but we then encrypt it using MD5. Hence, two warnings.

> If I use a real md5 password, it only complains about MD5 encrypted
> password:

Right. If someone sends us something that looks like an already-encrypted
password, we just store it. See get_password_type() in
backend/libpq/crypt.c. In which case, the actual password that a client
would type in would *not* be what was sent over the wire as part of the
ALTER USER / CREATE USER, so we don't complain.

Cheers,
Greg

--
Crunchy Data - https://www.crunchydata.com
Enterprise Postgres Software Products & Tech Support