From: raf@raf.org
To: pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Tue, 23 Apr 2019 07:49:24 +1000
Message-ID: <20190422214924.pytigrzlq7mkdyzq@raf.org> (raw)
In-Reply-To: <20190422135215.GG6197@tamriel.snowman.net>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
<4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
<20190422015051.GA3433@paquier.xyz>
<3033.1555940554@sss.pgh.pa.us>
<20190422135215.GG6197@tamriel.snowman.net>
Stephen Frost wrote:
> I agree we should also handle md5 better. I realize this needs to be
> back-patched and so we have to deal with the existing catalog structure,
> but this really screams out, in my mind anyway, that we shouldn't have
> ever tried to just stash the password-encoding-type into the password
> field and that we should have pulled it out into its own column, so that
> we aren't having to guess about things as important as a password.
>
> Thanks!
>
> Stephen
I don't think there's anything wrong with prefixing a
password hash with an identifier for the password
hashing scheme (and any parameters for that scheme).
This is done all the time in many systems. It just has
to be unambiguoous.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: raf@raf.org, pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-Reply-To: <20190422214924.pytigrzlq7mkdyzq@raf.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox