From: Nagy László Zsolt <gandalf@shopzeus.com>
To: pgsql-admin@postgresql.org
Subject: md5 auth procotol - can it be replayed?
Date: Sat, 7 May 2016 17:38:38 +0200
Message-ID: <572E0BFE.7040709@shopzeus.com> (raw)
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
How the md5 hashed authentication method works? Is it protected against
replay attacks? Here is what I have in mind:
* If the server stores salted hashed passwords, then I do not see how
the server could authenticate the users without getting the password in
clear text?
* If the server stores (unsalted) password hash values, then basically
there is almost no difference between a clear text password and an md5
hash, because anyone can replay the send the same hash value and log in
again.
Am I missing something?
Thanks,
Laszlo
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: gandalf@shopzeus.com
Subject: Re: md5 auth procotol - can it be replayed?
In-Reply-To: <572E0BFE.7040709@shopzeus.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox