MIME-Version: 1.0
References: <79692c1a-190c-413e-9442-a14a45c1069d@googlemail.com>
 <834558.1719102188@sss.pgh.pa.us> <43826fbd-2d26-467b-afcf-7fde609f8da3@googlemail.com>
In-Reply-To: <43826fbd-2d26-467b-afcf-7fde609f8da3@googlemail.com>
From: Greg Sabino Mullane <htamfids@gmail.com>
Date: Sun, 23 Jun 2024 11:09:26 -0400
Message-ID: <CAKAnmmL7a20MKmjJuQZsrZPqCoSfdi5xpCtL4eqTxmcCKefC6Q@mail.gmail.com>
Subject: Re: Password complexity/history - credcheck?
To: Martin Goodson <kaemaril@googlemail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000112fef061b900f63"
Archived-At: <https://www.postgresql.org/message-id/CAKAnmmL7a20MKmjJuQZsrZPqCoSfdi5xpCtL4eqTxmcCKefC6Q%40mail.gmail.com>
Precedence: bulk

--000000000000112fef061b900f63
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 23, 2024 at 5:30=E2=80=AFAM Martin Goodson <kaemaril@googlemail=
.com>
wrote:

> I believe that our security team is getting most of this from our
> auditors, who seem convinced that minimal complexity, password history
> etc are the way to go despite the fact that, as you say, server-side
> password checks can't really be implemented when the database receives a
> hash rather than a clear text password and password minimal complexity
> etc is not perhaps considered the gold standard it once was.
>
> In fact, I think they see a hashed password as a disadvantage.


Wow, full stop right there. This is a hill to die on.

Push back and get some competent auditors. This should not be a DBAs
problem. Your best bet is to use Kerberos, and throw the password
requirements out of the database realm entirely.

Also, the discussion should be about 2FA, not password history/complexity.

Cheers,
Greg

--000000000000112fef061b900f63
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sun, Jun 23, 2024 at 5:30=E2=80=AFAM M=
artin Goodson &lt;<a href=3D"mailto:kaemaril@googlemail.com">kaemaril@googl=
email.com</a>&gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">I believe that our security team is get=
ting most of this from our <br>
auditors, who seem convinced that minimal complexity, password history <br>
etc are the way to go despite the fact that, as you say, server-side <br>
password checks can&#39;t really be implemented when the database receives =
a <br>
hash rather than a clear text password and password minimal complexity <br>
etc is not perhaps considered the gold standard it once was.<br>
<br>
In fact, I think they see a hashed password as a disadvantage.</blockquote>=
<div><br></div><div>Wow, full stop right there. This is a hill to die on.</=
div><div><br></div><div>Push back and get some competent auditors. This sho=
uld not be a DBAs problem. Your best bet is to use Kerberos, and throw the =
password requirements out of the database realm entirely.</div><div><br></d=
iv><div>Also, the discussion should be about 2FA, not password history/comp=
lexity.</div><div><br></div><div>Cheers,</div><div>Greg</div><div><br></div=
></div></div>

--000000000000112fef061b900f63--