From: Stephen Frost <sfrost@snowman.net>
To: Josh Berkus <josh@agliodbs.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter_e@gmx.net>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Date: Wed, 12 Aug 2015 21:22:59 -0400
Message-ID: <20150813012259.GQ3685@tamriel.snowman.net> (raw)
In-Reply-To: <55CBB8D5.7040501@agliodbs.com>
References: <55CA4085.30101@gmx.net>
<CA+TgmoYVE3Cg_HG=uZ_2NfMBbRstgNVMsOeVxHbfCUZfDhfxaA@mail.gmail.com>
<55CB5D38.5090503@gmx.net>
<CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
<55CBA425.5070803@gmx.net>
<20150812200938.GM3685@tamriel.snowman.net>
<CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
<20150812203732.GN3685@tamriel.snowman.net>
<WM!23d4ca1d7810ef17da5bfb2bff2b30680a248a83e6156f0e4af5f37678c7a95b80c95c7478b39152f75efb8a862787fb!@asav-2.01.com>
<55CBB8D5.7040501@agliodbs.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
* Josh Berkus (josh@agliodbs.com) wrote:
> On 08/12/2015 01:37 PM, Stephen Frost wrote:
> > Would be great to get comments on the other comments, specifically that
> > adding SCRAM's password verifier won't seriously change the security of
> > a user's account or password based on an attack vector where the
> > contents of pg_authid is compromised. I do agree with the general
> > concern that the additional complexity involved in supporting multiple
> > password verifiers may result in bugs, and likely security ones, but I
> > really expect the larger risk to be from the SCRAM implementation itself
> > than how we get data into and back out of our own catalogs.
>
> There's also the concern that the additional complexity will cause
> *users* to make security-compromising mistakes, which I think is the
> greater risk. Robert has mostly won me over to his point of view on this.
That is certainly an issue to address- but that's one which I believe we
can address a great deal better than what we're doing with the currently
proposed patch. I do feel we need to provide flexibility and options,
but we also need to consider the simple case and make sure that it
remains simple.
> The only case where I can see multiple verifiers per role making a real
> difference in migrations is for PGAAS hosting. But the folks from
> Heroku and AWS have been notably silent on this; lemme ping them.
While their insight is certainly valuable, they are certainly not the
only cases of one-user-to-rule-them-all environments. Further, there's
going to be cases where multiple applications from different languages
are accessing the database through the same account because there's only
one account.
I'd rather not punt on those cases and, further, assume that we'll
always be able to keep it to only one password verifier per account. As
I tried to outline up-thread, there are a set of features which would be
very nice for us to have which require further information to be saved
beyond even these different password verifiers for each.
As mentioned elsewhere, even SCRAM is possible of having multiple
password verifiers based on the various algorithms used. In other
words, I doubt the 'only one password verifier per role' approach is
going to work out for us long term in any case.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, josh@agliodbs.com, robertmhaas@gmail.com, peter_e@gmx.net, hlinnaka@iki.fi, michael.paquier@gmail.com
Subject: Re: WIP: SCRAM authentication
In-Reply-To: <20150813012259.GQ3685@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox