pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jim Nasby <jnasby@upgrade.com>
Cc: Greg Sabino Mullane <htamfids@gmail.com>
Cc: Nathan Bossart <nathandbossart@gmail.com>
Cc: Andrew Dunstan <andrew@dunslane.net>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: sunsetting md5 password support
Date: Mon, 28 Oct 2024 17:24:02 -0400
Message-ID: <38126.1730150642@sss.pgh.pa.us> (raw)
In-Reply-To: <E70FC674-9B76-423C-A5F9-6372E828962E@upgrade.com>
References: <ZwbfpJJol7lDWajL@nathan>
	<7e9e3d30-f7f4-460f-a626-6cfad419d6cd@iki.fi>
	<76396e05-0724-4b17-9194-2875df40feb8@dunslane.net>
	<2735114.1728599306@sss.pgh.pa.us>
	<17ccc98a-108a-415d-a38c-f12b7baab90d@dunslane.net>
	<ZwmaW2AeUjBJGHgw@nathan>
	<Zw_cAwYO5bhaku3k@nathan>
	<Zx0RAAiMda8s0JZl@nathan>
	<CAKAnmmKq9EYTeUnmikfTL-1jKN2NXpGTN+8pYxsqfx3gYePEag@mail.gmail.com>
	<E70FC674-9B76-423C-A5F9-6372E828962E@upgrade.com>

Jim Nasby <jnasby@upgrade.com> writes:
> Patch itself looks good, but it does leave me wondering if cleartext should also be deprecated?

Not much point unless we also deprecate all of the other auth methods
that require cleartext password transmission, which from a quick
scan include PAM, BSD, LDAP, and RADIUS.  Seems unlikely to fly.

In any case, I don't think this is about password security per se.
It's more about deprecating a method that might look like it's
secure but isn't.  In the case of the cleartext-password methods,
it's obvious that you'd better use SSL or GSS encryption if you
want your password hidden from network tapping.

I don't recall how in-your-face we are about that point, but
certainly the docs need to be up front about it, and probably
make the point explicitly with respect to the four methods
listed above.

			regards, tom lane





view thread (32+ messages)  latest in thread

Message-ID: <38126.1730150642@sss.pgh.pa.us>
Permalink:  ../38126.1730150642@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/38126.1730150642@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, jnasby@upgrade.com, htamfids@gmail.com, nathandbossart@gmail.com, andrew@dunslane.net, hlinnaka@iki.fi
  Subject: Re: sunsetting md5 password support
  In-Reply-To: <38126.1730150642@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox