From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Jeff Janes <jeff.janes@gmail.com>, Magnus Hagander <magnus@hagander.net>,
        Thomas Munro <thomas.munro@gmail.com>, k.yudhveer@gmail.com,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #16079: Question Regarding the BUG #16064
In-reply-to: <20201221183511.GI27507@tamriel.snowman.net>
References: <16079-29e9c038e1463751@postgresql.org>
 <20191028154754.GS6962@tamriel.snowman.net>
 <CA+hUKGJw4Ax25=fcCA+DQD=82v2pKu9VGmkYZO8HeH7+-P2Cxw@mail.gmail.com>
 <CABUevEwMcFmXqPJgOQfnUV8XgKtWqHPiccNHY+mPJ0AfeFz-7Q@mail.gmail.com>
 <20201221005825.GQ16415@tamriel.snowman.net>
 <CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
 <543836.1608575492@sss.pgh.pa.us>
 <20201221183511.GI27507@tamriel.snowman.net>
Comments: In-reply-to Stephen Frost <sfrost@snowman.net>
	message dated "Mon, 21 Dec 2020 13:35:11 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <544463.1608576242.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 21 Dec 2020 13:44:02 -0500
Message-ID: <544464.1608576242@sss.pgh.pa.us>
Precedence: bulk

Stephen Frost <sfrost@snowman.net> writes:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> Jeff Janes <jeff.janes@gmail.com> writes:
>>> I would suggest going further.  I would make the change on the client =
side,
>>> and have libpq refuse to send unhashed passwords without having an
>>> environment variable set which allows it.

>> As noted, that would break LDAP and RADIUS auth methods; likely also PA=
M.

> Which would be an altogether good thing as all of those end up exposing
> sensitive information should the server be compromised and a user uses
> one of them to log in.

Hm.  I'm less concerned about that scenario than about somebody snooping
the on-the-wire traffic.  If we're going to invent a connection setting
for this, I'd say that in addition to "ok to send cleartext password"
and "never ok to send cleartext password", there should be a setting for
"send cleartext password only if connection is encrypted".  Possibly
that should even be the default.

(I guess Unix-socket connections would be an exception, since we never
encrypt those.)

BTW, do we have a client-side setting to insist that passwords not be
sent in MD5 hashing either?  A person who is paranoid about this would
likely want to disable that code path as well.

			regards, tom lane