Received: from maia.hub.org (maia-3.hub.org [200.46.204.243]) by mail.postgresql.org (Postfix) with ESMTP id AF153632D4D for ; Thu, 8 Jul 2010 08:12:34 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.243]) (amavisd-maia, port 10024) with ESMTP id 26648-05 for ; Thu, 8 Jul 2010 11:12:25 +0000 (UTC) X-Greylist: delayed 00:25:59.916975 by SQLgrey-1.7.6 Received: from fallback2.mel.teaser.net (fallback2.mel.teaser.net [213.162.54.29]) by mail.postgresql.org (Postfix) with ESMTP id B163862DBF4 for ; Thu, 8 Jul 2010 08:12:26 -0300 (ADT) Received: from smtpout2.mel.teaser.net (smtpout2.mel.teaser.net [213.162.54.61]) by fallback2.mel.teaser.net (Postfix) with ESMTP id A5A2F1EFA3F4 for ; Thu, 8 Jul 2010 12:46:27 +0200 (CEST) Received: from atc5.vermine.org (aym.net2.nerim.net [213.41.173.68]) by smtpout2.mel.teaser.net (Postfix) with ESMTPA id D0B136F11 for ; Thu, 8 Jul 2010 12:46:23 +0200 (CEST) Received: from aym by atc5.vermine.org with local (Exim 4.69) (envelope-from ) id 1OWocZ-0000ZN-2W for pgsql-docs@postgresql.org; Thu, 08 Jul 2010 12:46:23 +0200 Date: Thu, 8 Jul 2010 12:46:22 +0200 From: Andre Majorel To: pgsql-docs@postgresql.org Subject: MD5 passwords Message-ID: <20100708104622.GA2132@aym.net2.nerim.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.5.20 (2009-06-14) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-0.001 tagged_above=-5 required=5 tests=BAYES_20=-0.001 X-Spam-Level: X-Archive-Number: 201007/62 X-Sequence-Number: 5718 The doc says « if you are at all concerned about password "sniffing" attacks then md5 is preferred. » but does not say why. It would seem that an MD5 hash can be sniffed and replayed just as well as a clear-text password. Maybe the doc needs to explain why "md5" is more secure than "password". Or, if it isn't, say so. -- André Majorel http://www.teaser.fr/~amajorel/