| From: | The Hermit Hacker <scrappy(at)hub(dot)org> |
|---|---|
| To: | Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> |
| Cc: | PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Passwords |
| Date: | 2000-05-07 01:54:37 |
| Message-ID: | Pine.BSF.4.21.0005062253210.87721-100000@thelab.hub.org |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Sat, 6 May 2000, Bruce Momjian wrote:
> Added to TODO:
>
> * Encrpyt passwords in pg_shadow table using MD5
Under FreeBSD, if you use crypt() for encrypting, and you are outside of
the 'export restricted area', you auto-get MD5 vs DES ... I think if DES
is available, it should be used over MD5, if we're doing this for security
reasons ...
My *understanding* is that MD5 is a half-way measure that is easier to
break then DES, which is why it isn't under the export restrictions ...
Marc G. Fournier ICQ#7615664 IRC Nick: Scrappy
Systems Administrator @ hub.org
primary: scrappy(at)hub(dot)org secondary: scrappy(at){freebsd|postgresql}.org
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Robert B. Easter | 2000-05-07 02:02:04 | Re: You're on SecurityFocus.com for the cleartext passwords. |
| Previous Message | Hiroshi Inoue | 2000-05-06 23:50:16 | RE: pg_group_name_index corrupt? |