Re: Rejecting weak passwords

Bruce Momjian wrote:
>Tom Lane wrote:
>> > That said, it would still be good to have something actually *useful*
>> > in contrib. A bit more than just comparing userid and password.
>> > Perhaps at least being able to set the min length, and the requirement
>> > on having >1 "character class"?
>>
>> +1. There's still the issue of not being able to do much with a
>> pre-MD5'd password, though.
>
> Agreed. I am still a little worried that people will think they are
> checking for weak passwords when, for MD5, they are not. I am also
> worried that people will unknowingly reduce their security (not use MD5)
> to allow weak password checking.

I will write a contrib that does some password checking.

I'll add comments to the code to show where and how to add cracklib
if you want to.

I will write a conspicuous noisy warning into the README that
warns about the limits with respect to MD5 and states that for really
good security you should consider external authentication.

Due to time constraints at work I won't be able to start working on
it before end of next week.

Yours,
Laurenz Albe