From: Andre Majorel <aym-2lqsgp@teaser.fr>
To: pgsql-docs@postgresql.org
Subject: MD5 passwords
Date: Thu, 8 Jul 2010 12:46:22 +0200
Message-ID: <20100708104622.GA2132@aym.net2.nerim.net> (raw)
The doc says « if you are at all concerned about password
"sniffing" attacks then md5 is preferred. » but does not say why.
It would seem that an MD5 hash can be sniffed and replayed just as
well as a clear-text password.
Maybe the doc needs to explain why "md5" is more secure than
"password". Or, if it isn't, say so.
--
André Majorel http://www.teaser.fr/~amajorel/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: aym-2lqsgp@teaser.fr
Subject: Re: MD5 passwords
In-Reply-To: <20100708104622.GA2132@aym.net2.nerim.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox