Deprecating plans for PGPASSWORD environment variable as insecure

From: Alexey Murz Korepov <murznn(at)gmail(dot)com>
To: pgadmin-support(at)lists(dot)postgresql(dot)org
Subject: Deprecating plans for PGPASSWORD environment variable as insecure
Date: 2021-12-27 08:37:23
Message-ID: CAL5pyKsEjKn0r_pY8jsO8VGkPdNX=Azh7vr9VSDz4mxKDgxx1w@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgadmin-support

MySQL in version have deprecated the `MYSQL_PWD` environment variable,
because they considers this way as insecure, quote from
https://dev.mysql.com/doc/refman/8.0/en/environment-variables.html#idm45429554761920
:

> Use of MYSQL_PWD to specify a MySQL password must be considered
extremely insecure and should not be used. Some versions of ps include an
option to display the environment of running processes. On some systems, if
you set MYSQL_PWD, your password is exposed to any other user who runs ps.
Even on systems without such a version of ps, it is unwise to assume that
there are no other methods by which users can examine process environments.

So I want to ask - is there the same plan for PostgreSQL with it's
`PGPASSWORD` environment variable for future versions, or will it stay as
non-deprecated for future versions, and we can continue to use it without
worrying?

--
Best regards,
Alexey Murz Korepov.
E-mail: murznn(at)gmail(dot)com
Messengers: Matrix - https://matrix.to/#/@murz:ru-matrix.org Telegram -
@MurzNN

Responses

Browse pgadmin-support by date

  From Date Subject
Next Message Khushboo Vashi 2021-12-27 08:44:40 Re: Deprecating plans for PGPASSWORD environment variable as insecure
Previous Message Aditya Toshniwal 2021-12-27 05:06:38 Re: I cannot get PGAdmin to load the servers.