From: Stephen Frost <sfrost@snowman.net>
To: raf@raf.org
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Tue, 23 Apr 2019 10:42:00 -0400
Message-ID: <20190423144159.GP6197@tamriel.snowman.net> (raw)
In-Reply-To: <20190422214924.pytigrzlq7mkdyzq@raf.org>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
<4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
<20190422015051.GA3433@paquier.xyz>
<3033.1555940554@sss.pgh.pa.us>
<20190422135215.GG6197@tamriel.snowman.net>
<20190422214924.pytigrzlq7mkdyzq@raf.org>
Greetings,
* raf@raf.org (raf@raf.org) wrote:
> Stephen Frost wrote:
> > I agree we should also handle md5 better. I realize this needs to be
> > back-patched and so we have to deal with the existing catalog structure,
> > but this really screams out, in my mind anyway, that we shouldn't have
> > ever tried to just stash the password-encoding-type into the password
> > field and that we should have pulled it out into its own column, so that
> > we aren't having to guess about things as important as a password.
>
> I don't think there's anything wrong with prefixing a
> password hash with an identifier for the password
> hashing scheme (and any parameters for that scheme).
> This is done all the time in many systems. It just has
> to be unambiguoous.
There isn't a way to make it unambiguous given that we accept
more-or-less anything as a plaintext password though, that would be the
issue here..
Thanks!
Stephen
Attachments:
[application/pgp-signature] signature.asc (818B, ../20190423144159.GP6197@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: sfrost@snowman.net, raf@raf.org, pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-Reply-To: <20190423144159.GP6197@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox