From: Magnus Hagander <magnus@hagander.net>
To: Tony Caduto <tony_caduto@amsoftwaredesign.com>
Cc: pgsql-general@postgresql.org
Subject: Re: Password issue revisited
Date: Tue, 20 Feb 2007 20:04:04 +0100
Message-ID: <45DB4624.4060800@hagander.net> (raw)
In-Reply-To: <45DB448A.3040308@amsoftwaredesign.com>
References: <45BCACDB.5050702@007Marketing.com>
<200702201449.l1KEn0r21849@momjian.us>
<20070220150507.GD11927@svr2.hagander.net>
<45DB448A.3040308@amsoftwaredesign.com>
Tony Caduto wrote:
> Magnus Hagander wrote:
>> Are we sure we want to do this? (Sorry, didn't notice this thread last
>> time)
>>
>> The default on *all* windows versions since NT 4.0 (which is when the
>> directory we use was added) will put this file in a protected directory.
>>
> Is there truly such a thing on a windows PC? All it takes is one Virus
> or Malware to gain access to the PC and anything stored in the
> user profile is easy picking.
> The virus and malware creators may not know about the pg_pass file now,
> but they will eventually.
> What about having a wallet type system where the user can create a pass
> phrase to protect a generated key that would get
> loaded once per session. That is how KDE allows users to store passwords.
>
> I work at a large financial institution and if the auditors knew about
> the pg_pass being plain text, they would pretty much ban
> it's use.
>
> Anytime a password is sitting on a non encrypted file system, regardless
> of it's permissions it is potentially at risk.
If we wanted to do that, we could use the Windows API that's available
to do this. The idea with the pgpass flie is to have it compatible with
the unix version.
//Magnus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: magnus@hagander.net, tony_caduto@amsoftwaredesign.com, pgsql-general@postgresql.org
Subject: Re: Password issue revisited
In-Reply-To: <45DB4624.4060800@hagander.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox