From: Bruce Momjian <bruce@momjian.us>
To: jens.timmerman@gmail.com
Cc: pgsql-docs@postgresql.org
Subject: Re: does md5 really help against sniffing?
Date: Thu, 25 Aug 2016 18:41:43 -0400
Message-ID: <20160825224143.GA26412@momjian.us> (raw)
In-Reply-To: <20160825153517.15679.54325@wrigleys.postgresql.org>
References: <20160825153517.15679.54325@wrigleys.postgresql.org>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-docs>
On Thu, Aug 25, 2016 at 03:35:17PM +0000, jens.timmerman@gmail.com wrote:
> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/9.1/static/auth-methods.html
> Description:
>
> this page claims
> 'If you are at all concerned about password "sniffing" attacks then md5 is
> preferred. '
> but how does this really help? If an md5 hash is enough to get access, then
> sniffing an md5has is actually the same as sniffing the password?'
There is random salt added to the network md5 hash. Please read the
docs on this.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: bruce@momjian.us, jens.timmerman@gmail.com
Subject: Re: does md5 really help against sniffing?
In-Reply-To: <20160825224143.GA26412@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox