pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feeddoes md5 really help against sniffing?
2+ messages / 2 participants
[nested] [flat]
* does md5 really help against sniffing?
@ 2016-08-25 15:35 jens.timmerman@gmail.com
2016-08-25 22:41 ` Re: does md5 really help against sniffing? Bruce Momjian <bruce@momjian.us>
0 siblings, 1 reply; 2+ messages in thread
From: jens.timmerman@gmail.com @ 2016-08-25 15:35 UTC (permalink / raw)
To: pgsql-docs
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/9.1/static/auth-methods.html
Description:
this page claims
'If you are at all concerned about password "sniffing" attacks then md5 is
preferred. '
but how does this really help? If an md5 hash is enough to get access, then
sniffing an md5has is actually the same as sniffing the password?'
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: does md5 really help against sniffing?
2016-08-25 15:35 does md5 really help against sniffing? jens.timmerman@gmail.com
@ 2016-08-25 22:41 ` Bruce Momjian <bruce@momjian.us>
0 siblings, 0 replies; 2+ messages in thread
From: Bruce Momjian @ 2016-08-25 22:41 UTC (permalink / raw)
To: jens.timmerman@gmail.com; +Cc: pgsql-docs
On Thu, Aug 25, 2016 at 03:35:17PM +0000, jens.timmerman@gmail.com wrote:
> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/9.1/static/auth-methods.html
> Description:
>
> this page claims
> 'If you are at all concerned about password "sniffing" attacks then md5 is
> preferred. '
> but how does this really help? If an md5 hash is enough to get access, then
> sniffing an md5has is actually the same as sniffing the password?'
There is random salt added to the network md5 hash. Please read the
docs on this.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2016-08-25 22:41 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2016-08-25 15:35 does md5 really help against sniffing? jens.timmerman@gmail.com
2016-08-25 22:41 ` Bruce Momjian <bruce@momjian.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox