From: Tom Lane <tgl@sss.pgh.pa.us>
To: Pavel Borisov <pashkin.elfe@gmail.com>
cc: noloader@gmail.com, Magnus Hagander <magnus@hagander.net>,
        PostgreSQL mailing lists <pgsql-bugs@postgresql.org>
Subject: Re: [OT] Microsoft: Kubernetes clusters hacked in malware campaign
 via PostgreSQL
In-reply-to: 
 <CALT9ZEGsd9cP25=PrtVuOHNb4FAM4EJTiMNEr8jo7rUeV4fbTA@mail.gmail.com>
References: 
 <CAH8yC8=oe+Pm+j0xz-4Hh_LYrRbZ92bq=iOa236bEV+68CgHsQ@mail.gmail.com>
 <CABUevEy=JV6ND-h38UNEnBG4zX=vGrWt1v-iF9q0PDh4FewCMw@mail.gmail.com>
 <CAH8yC8marSG+mhuKSFj01EFziZrQK4hGThx7dtE64y7SH5m2Qw@mail.gmail.com>
 <CALT9ZEGG6DPg=ahRSMBOEMg6OuRJx3Tsrfnw8DtVQ4HHybyWPQ@mail.gmail.com>
 <CABUevEzmWBcpMr_VLqUyWSsuGcOmYX9y+hCptu9aJ+VfN2Ccrg@mail.gmail.com>
 <CALT9ZEFN+jAbaLs12p-np8VXVMYswV7uU03xHjPXAZugaa1ehQ@mail.gmail.com>
 <CAH8yC8nwHw9CqBr+fPwRCB0UfArdOC7b6-tL1DYO1EsZ8MXLig@mail.gmail.com>
 <CABUevEzq6uv39wUyu=zBW6NezXvm25U3R4i9W5+_g28KWWqT7w@mail.gmail.com>
 <CAH8yC8kGR0YHoCZf2TXhxJS9-FDhPaMCpo89CCXn=kGtVbRn5Q@mail.gmail.com>
 <CALT9ZEGsd9cP25=PrtVuOHNb4FAM4EJTiMNEr8jo7rUeV4fbTA@mail.gmail.com>
Comments: In-reply-to Pavel Borisov <pashkin.elfe@gmail.com>
	message dated "Tue, 10 Jan 2023 19:20:16 +0300"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <379033.1673389287.1@sss.pgh.pa.us>
Date: Tue, 10 Jan 2023 17:21:27 -0500
Message-ID: <379034.1673389287@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/379034.1673389287%40sss.pgh.pa.us>
Precedence: bulk

Pavel Borisov <pashkin.elfe@gmail.com> writes:
> Regarding the fact that using weak passwords isn't limited, I think
> anyone can write an extension that limits (or advises against) weak
> passwords based on the author's definition of weakness, like checking
> by dictionary or so. That's the power of Postgres extensibility. I
> don't like an idea that Postgres core should enforce some arbitrary
> things like "weakness".

It's less easy than it sounds, actually, because current best practice
is that the server will never see the cleartext password at all, so
you can't apply the usual litany of weak-password checks.  About all
you can do is apply a brute force rainbow attack, which is far from
cheap (although I guess the DBA could run such checks in the background).
Even that might be rendered infeasible if the password is stored as
a SCRAM verifier; I'm not sure about that.  Anyway, this is why
contrib/passwordcheck is a development backwater rather than something
people actually use.

			regards, tom lane