pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedMD5 passwords
3+ messages / 2 participants
[nested] [flat]
* MD5 passwords
@ 2010-07-08 10:46 Andre Majorel <aym-2lqsgp@teaser.fr>
0 siblings, 1 reply; 3+ messages in thread
From: Andre Majorel @ 2010-07-08 10:46 UTC (permalink / raw)
To: pgsql-docs
The doc says « if you are at all concerned about password
"sniffing" attacks then md5 is preferred. » but does not say why.
It would seem that an MD5 hash can be sniffed and replayed just as
well as a clear-text password.
Maybe the doc needs to explain why "md5" is more secure than
"password". Or, if it isn't, say so.
--
André Majorel http://www.teaser.fr/~amajorel/
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: MD5 passwords
@ 2010-07-08 13:05 Thom Brown <thombrown@gmail.com>
parent: Andre Majorel <aym-2lqsgp@teaser.fr>
0 siblings, 1 reply; 3+ messages in thread
From: Thom Brown @ 2010-07-08 13:05 UTC (permalink / raw)
To: Andre Majorel <aym-2lqsgp@teaser.fr>; +Cc: pgsql-docs
On 8 July 2010 11:46, Andre Majorel <aym-2lqsgp@teaser.fr> wrote:
> The doc says « if you are at all concerned about password
> "sniffing" attacks then md5 is preferred. » but does not say why.
> It would seem that an MD5 hash can be sniffed and replayed just as
> well as a clear-text password.
>
> Maybe the doc needs to explain why "md5" is more secure than
> "password". Or, if it isn't, say so.
>
I believe the client hashes the password using MD5 and a salt, the
latter part being a random one sent to the client by the server, so
sniffing the password would be useless as you would have to have
sniffed the salt (strange phrase but there you go), have sniffed the
password, *and* be asked for exactly the same salt by the server
again.
I'm sure that's mentioned in the docs somewhere, although not on the
normal authentication page.
Thom
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: MD5 passwords
@ 2010-07-08 14:23 Thom Brown <thombrown@gmail.com>
parent: Thom Brown <thombrown@gmail.com>
0 siblings, 0 replies; 3+ messages in thread
From: Thom Brown @ 2010-07-08 14:23 UTC (permalink / raw)
To: Andre Majorel <aym-2lqsgp@teaser.fr>; +Cc: pgsql-docs
On 8 July 2010 14:05, Thom Brown <thombrown@gmail.com> wrote:
> On 8 July 2010 11:46, Andre Majorel <aym-2lqsgp@teaser.fr> wrote:
>> The doc says « if you are at all concerned about password
>> "sniffing" attacks then md5 is preferred. » but does not say why.
>> It would seem that an MD5 hash can be sniffed and replayed just as
>> well as a clear-text password.
>>
>> Maybe the doc needs to explain why "md5" is more secure than
>> "password". Or, if it isn't, say so.
>>
>
> I believe the client hashes the password using MD5 and a salt, the
> latter part being a random one sent to the client by the server, so
> sniffing the password would be useless as you would have to have
> sniffed the salt (strange phrase but there you go), have sniffed the
> password, *and* be asked for exactly the same salt by the server
> again.
>
> I'm sure that's mentioned in the docs somewhere, although not on the
> normal authentication page.
>
Aha, I've found it:
http://www.postgresql.org/docs/current/static/encryption-options.html
Thom
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2010-07-08 14:23 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2010-07-08 10:46 MD5 passwords Andre Majorel <aym-2lqsgp@teaser.fr>
2010-07-08 13:05 ` Thom Brown <thombrown@gmail.com>
2010-07-08 14:23 ` Thom Brown <thombrown@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox