Subject: Re: removal of md5 from example code
To: jonwolski@gmail.com, pgsql-docs@lists.postgresql.org
References: <20180117161459.3623.50555@wrigleys.postgresql.org>
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Organization: 2ndQuadrant
Message-ID: <5dba9c6c-19fe-6095-ff83-d8d9e29d0e93@2ndquadrant.com>
Date: Tue, 30 Jan 2018 23:02:04 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0)
 Gecko/20100101 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <20180117161459.3623.50555@wrigleys.postgresql.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 1/17/18 11:14, PG Doc comments form wrote:
> The documentation at
> https://www.postgresql.org/docs/current/static/citext.html shows an example
> using md5 for password hashes. This is generally a bad practice and not
> relevant to the feature documented. 
> 
> I recommend removing the password column from this example or replacing the
> md5 hash with something more secure (a secure hash algorithm with a salt).

We don't have any other hash functions built in and exposed at the SQL
level.  (Maybe that is a problem.)  Do you have any other ideas how to
rewrite that example?

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services