Date: Thu, 25 Aug 2016 18:41:43 -0400
From: Bruce Momjian <bruce@momjian.us>
To: jens.timmerman@gmail.com
Cc: pgsql-docs@postgresql.org
Subject: Re: does md5 really help against sniffing?
Message-ID: <20160825224143.GA26412@momjian.us>
References: <20160825153517.15679.54325@wrigleys.postgresql.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20160825153517.15679.54325@wrigleys.postgresql.org>
User-Agent: Mutt/1.5.23 (2014-03-12)
Precedence: bulk
Sender: pgsql-docs-owner@postgresql.org

On Thu, Aug 25, 2016 at 03:35:17PM +0000, jens.timmerman@gmail.com wrote:
> The following documentation comment has been logged on the website:
> 
> Page: https://www.postgresql.org/docs/9.1/static/auth-methods.html
> Description:
> 
> this page claims
> &#39;If you are at all concerned about password &quot;sniffing&quot; attacks then md5 is
> preferred. &#39;
> but how does this really help? If an md5 hash is enough to get access, then
> sniffing an md5has is actually the same as sniffing the password?&#39;

There is random salt added to the network md5 hash.  Please read the
docs on this.

-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

+ As you are, so once was I. As I am, so you will be. +
+                     Ancient Roman grave inscription +


-- 
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs