From: Stephen Frost <sfrost@snowman.net>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter_e@gmx.net>
Cc: Josh Berkus <josh@agliodbs.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Date: Wed, 12 Aug 2015 16:37:32 -0400
Message-ID: <20150812203732.GN3685@tamriel.snowman.net> (raw)
In-Reply-To: <CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
References: <WM!2607bf41b9a89b33119972f5b4afde40079604473d0e477f1dc436a9fa9e91fbe0abb7b542ebd7beba5c4d754eca070e!@asav-3.01.com>
<55C79F0A.90601@agliodbs.com>
<CA+TgmobMFiHiHt2_weFhZ-99kQNQz+h3mkTzm1aOX4ZMwOH-Yg@mail.gmail.com>
<55CA4085.30101@gmx.net>
<CA+TgmoYVE3Cg_HG=uZ_2NfMBbRstgNVMsOeVxHbfCUZfDhfxaA@mail.gmail.com>
<55CB5D38.5090503@gmx.net>
<CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
<55CBA425.5070803@gmx.net>
<20150812200938.GM3685@tamriel.snowman.net>
<CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Robert,
* Robert Haas (robertmhaas@gmail.com) wrote:
> On Wed, Aug 12, 2015 at 4:09 PM, Stephen Frost <sfrost@snowman.net> wrote:
> > As for the notion of dropping md5 from 9.6 or even forcing it to be
> > one-or-the-other on a per-role basis, ...
>
> Please don't conflate those two things. They are radically different
> in terms of the amount of upgrade pain that they cause. The first one
> would be completely insane.
Thanks for the clarification. I had gotten the (apparently mistaken)
impression[1] that there was some consideration for a hard break from
one release to the next to move from md5 to SCRAM.
Would be great to get comments on the other comments, specifically that
adding SCRAM's password verifier won't seriously change the security of
a user's account or password based on an attack vector where the
contents of pg_authid is compromised. I do agree with the general
concern that the additional complexity involved in supporting multiple
password verifiers may result in bugs, and likely security ones, but I
really expect the larger risk to be from the SCRAM implementation itself
than how we get data into and back out of our own catalogs.
Thanks!
Stephen
[1]: CA+TgmoYQ=8BR87xgGkEWs8HJSe3KQh5v4fq+bZ2SAZhAnH3MtQ@mail.gmail.com
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, robertmhaas@gmail.com, peter_e@gmx.net, josh@agliodbs.com, hlinnaka@iki.fi, michael.paquier@gmail.com
Subject: Re: WIP: SCRAM authentication
In-Reply-To: <20150812203732.GN3685@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox