Date: Mon, 21 Dec 2020 13:53:19 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Janes <jeff.janes@gmail.com>,
	Magnus Hagander <magnus@hagander.net>,
	Thomas Munro <thomas.munro@gmail.com>, k.yudhveer@gmail.com,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #16079: Question Regarding the BUG #16064
Message-ID: <20201221185319.GL27507@tamriel.snowman.net>
References: <16079-29e9c038e1463751@postgresql.org>
 <20191028154754.GS6962@tamriel.snowman.net>
 <CA+hUKGJw4Ax25=fcCA+DQD=82v2pKu9VGmkYZO8HeH7+-P2Cxw@mail.gmail.com>
 <CABUevEwMcFmXqPJgOQfnUV8XgKtWqHPiccNHY+mPJ0AfeFz-7Q@mail.gmail.com>
 <20201221005825.GQ16415@tamriel.snowman.net>
 <CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
 <543836.1608575492@sss.pgh.pa.us>
 <20201221183511.GI27507@tamriel.snowman.net>
 <544464.1608576242@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="M2Pxvdb9QxnGd/3e"
Content-Disposition: inline
In-Reply-To: <544464.1608576242@sss.pgh.pa.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--M2Pxvdb9QxnGd/3e
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > * Tom Lane (tgl@sss.pgh.pa.us) wrote:
> >> Jeff Janes <jeff.janes@gmail.com> writes:
> >>> I would suggest going further.  I would make the change on the client=
 side,
> >>> and have libpq refuse to send unhashed passwords without having an
> >>> environment variable set which allows it.
>=20
> >> As noted, that would break LDAP and RADIUS auth methods; likely also P=
AM.
>=20
> > Which would be an altogether good thing as all of those end up exposing
> > sensitive information should the server be compromised and a user uses
> > one of them to log in.
>=20
> Hm.  I'm less concerned about that scenario than about somebody snooping
> the on-the-wire traffic.  If we're going to invent a connection setting
> for this, I'd say that in addition to "ok to send cleartext password"
> and "never ok to send cleartext password", there should be a setting for
> "send cleartext password only if connection is encrypted".  Possibly
> that should even be the default.

I'd still strongly advocate for "never ok to send cleartext password" to
be the default, otherwise we put this out and then everyone ends up
having to include "set this on all your clients to never allow it" in
their hardening guidelines.  That's really not ideal.

That said, having such an option would certainly be better than not
having any reasonable way on the client side to make sure that the
user's password isn't being sent to the server.

> (I guess Unix-socket connections would be an exception, since we never
> encrypt those.)

For the middle-ground "I don't care if the server sees my password, but
don't want someone on the network seeing it" it would seem unix sockets
would be alright.

> BTW, do we have a client-side setting to insist that passwords not be
> sent in MD5 hashing either?  A person who is paranoid about this would
> likely want to disable that code path as well.

No, but it would surely be good if we did... or we could just rip out
the md5 support entirely.

(Yes, I appreciate that the position I'm taking here isn't likely to be
popular and I'm not going to completely say no to compromises, but every
kind of compromise like these invites users to end up doing the insecure
thing; the more difficult we make it to do the insecure thing the better
overall for security.)

Thanks,

Stephen

--M2Pxvdb9QxnGd/3e
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJf4O8fAAoJEO1sijiDR2RVzwwP/2ltXJLT/MTVxSifXXa2VsJ/
fvV1CLqexKvQTG+jxHxVS+TnPeIn7SLLd5H842bIGrxnldn4gpquL8LLPoP0YIrQ
JbqNS+ZtuI9odBcdsXk3hcM/PsEhThp3ZKjRZMV0SVVgIkIswjePre7dZ9WmWS7S
tlFbzVRhvrTk2drl1OFxYwXoBlC2rHw7zhhslKDrgoPk3qiPjAnKTEtGwQ3Vv6O0
dt5hIqq1DmPh+tTU80PN7X94gjk1uFm8dv1pdc5ETL4chjgBSCmU/SVZr+X+2zth
faoew748cpBxE8Ic8qWlsxVyqLIQaxw5FpZZt/eriFXjURGSJ5/dIA4Wf4J9lvCE
5BRJeAECquC3v8ABkRb4HBQl7N3YLpRKgNJWXJRi36Bw1m3v5O1GAXqeJiNQr4rf
Azz3OUA1Qy/tXVULMuceGTCxCeM8UYiBhES7KtIjk9Is1syXNVJz27sh38NdNZqc
9fFhpxavYn7/HgJz9uZm+r3pAXfHeSXYqhAfWZY0Icrj9f4hWeFxOVohxdD2z10x
AHYu2biL2P4kPn4TQyGSElsko4ZRTB+2IYXMBezoLNgTXfqrHrW11pfAK4FFphsi
/XxpPXwasyFYChGByUj1sVh6T/iVqm6WdKsKYljKg9T+ywyhbc3Xlc4/W7ZhrMsU
os4NpbBriz/PoPUDjNY2
=PfMU
-----END PGP SIGNATURE-----

--M2Pxvdb9QxnGd/3e--