public inbox for [email protected]  

help / color / mirror / Atom feed

From: Martin Goodson <[email protected]>
To: Tom Lane <[email protected]>
Cc: [email protected]
Subject: Re: Password complexity/history - credcheck?
Date: Sun, 23 Jun 2024 10:30:17 +0100
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>

On 23/06/2024 01:23, Tom Lane wrote:

> Don't suppose it would help to push back on whether your security
> team knows what they're doing.
> ...
> Anyway, considerations like these are why there's not features
> of this sort in community PG.  You can use an extension that
> applies some checks, but there's no good way around the "needs
> cleartext password" problem for that.
>
> 			regards, tom lane

I believe that our security team is getting most of this from our 
auditors, who seem convinced that minimal complexity, password history 
etc are the way to go despite the fact that, as you say, server-side 
password checks can't really be implemented when the database receives a 
hash rather than a clear text password and password minimal complexity 
etc is not perhaps considered the gold standard it once was.

In fact, I think they see a hashed password as a disadvantage.

credcheck seems to satisfy their requirements - password complexity, 
password history, etc but - and this is the crucial bit - only on 
cleartext passwords.

If I'm forced to go to cleartext passwords, which would be a nightmare, 
credcheck might be worth looking at, but I'm not sure whether or not it 
is well adopted, reliable, and without significant issues. I only heard 
about it a few days ago from a friend/colleague, so I was wondering if 
anybody else was using it and what experiences with it might be.

Regards,

Martin.

-- 
Martin Goodson.

"Have you thought up some clever plan, Doctor?"
"Yes, Jamie, I believe I have."
"What're you going to do?"
"Bung a rock at it."

view thread (9+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: Password complexity/history - credcheck?
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox