MIME-Version: 1.0
References: <20250112222828.b36hpzm3ulfzlkws@hjp.at> <372571.1736722760@sss.pgh.pa.us>
In-Reply-To: <372571.1736722760@sss.pgh.pa.us>
From: Isaac Morland <isaac.morland@gmail.com>
Date: Sun, 12 Jan 2025 19:15:57 -0500
Message-ID: <CAMsGm5coc93kLUHN81BzYz7j1stBW3BJkgnrcw+GGKxf4ZjUfA@mail.gmail.com>
Subject: Re: Automatic upgrade of passwords from md5 to scram-sha256
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: "Peter J. Holzer" <hjp-pgsql@hjp.at>, pgsql-general@postgresql.org
Content-Type: multipart/alternative; boundary="000000000000e524d0062b8b59ee"
Archived-At: <https://www.postgresql.org/message-id/CAMsGm5coc93kLUHN81BzYz7j1stBW3BJkgnrcw%2BGGKxf4ZjUfA%40mail.gmail.com>
Precedence: bulk

--000000000000e524d0062b8b59ee
Content-Type: text/plain; charset="UTF-8"

On Sun, 12 Jan 2025 at 17:59, Tom Lane <tgl@sss.pgh.pa.us> wrote:

> "Peter J. Holzer" <hjp-pgsql@hjp.at> writes:
> > The web framework Django will automatically and transparently rehash any
> > password with the currently preferred algorithm if it isn't stored that
> > way already.
>
> Really?  That implies that the framework has access to the original
> cleartext password, which is a security fail already.


It happens upon user login. If the user's password is hashed with an old
algorithm, it is re-hashed during login when the Django application running
on the Web server has the password sent by the user:

https://docs.djangoproject.com/en/5.1/topics/auth/passwords/#password-upgrading

But of course this only works if the old method in use involves sending the
password to the server.

--000000000000e524d0062b8b59ee
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sun, 12 Jan 2025 at 17:59, Tom Lane &l=
t;<a href=3D"mailto:tgl@sss.pgh.pa.us">tgl@sss.pgh.pa.us</a>&gt; wrote:<br>=
</div><div class=3D"gmail_quote gmail_quote_container"><blockquote class=3D=
"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;borde=
r-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">&qu=
ot;Peter J. Holzer&quot; &lt;<a href=3D"mailto:hjp-pgsql@hjp.at" target=3D"=
_blank">hjp-pgsql@hjp.at</a>&gt; writes:<br>
&gt; The web framework Django will automatically and transparently rehash a=
ny<br>
&gt; password with the currently preferred algorithm if it isn&#39;t stored=
 that<br>
&gt; way already.<br>
<br>
Really?=C2=A0 That implies that the framework has access to the original<br=
>
cleartext password, which is a security fail already.</blockquote><div><br>=
</div><div>It happens upon user login. If the user&#39;s password is hashed=
 with an old algorithm, it is re-hashed during login when the Django applic=
ation running on the Web server has the password sent by the user:</div><di=
v><br></div><div><a href=3D"https://docs.djangoproject.com/en/5.1/topics/au=
th/passwords/#password-upgrading">https://docs.djangoproject.com/en/5.1/top=
ics/auth/passwords/#password-upgrading</a><br></div><div><br></div><div>But=
 of course this only works if the old method in use involves sending the pa=
ssword to the server.</div></div></div>

--000000000000e524d0062b8b59ee--