pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Josh Berkus <josh@agliodbs.com>
To: Stephen Frost <sfrost@snowman.net>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter_e@gmx.net>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Date: Wed, 12 Aug 2015 14:21:25 -0700
Message-ID: <55CBB8D5.7040501@agliodbs.com> (raw)
In-Reply-To: <WM!23d4ca1d7810ef17da5bfb2bff2b30680a248a83e6156f0e4af5f37678c7a95b80c95c7478b39152f75efb8a862787fb!@asav-2.01.com>
References: <WM!2607bf41b9a89b33119972f5b4afde40079604473d0e477f1dc436a9fa9e91fbe0abb7b542ebd7beba5c4d754eca070e!@asav-3.01.com>
	<55C79F0A.90601@agliodbs.com>
	<CA+TgmobMFiHiHt2_weFhZ-99kQNQz+h3mkTzm1aOX4ZMwOH-Yg@mail.gmail.com>
	<55CA4085.30101@gmx.net>
	<CA+TgmoYVE3Cg_HG=uZ_2NfMBbRstgNVMsOeVxHbfCUZfDhfxaA@mail.gmail.com>
	<55CB5D38.5090503@gmx.net>
	<CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
	<55CBA425.5070803@gmx.net>
	<20150812200938.GM3685@tamriel.snowman.net>
	<CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
	<20150812203732.GN3685@tamriel.snowman.net>
	<WM!23d4ca1d7810ef17da5bfb2bff2b30680a248a83e6156f0e4af5f37678c7a95b80c95c7478b39152f75efb8a862787fb!@asav-2.01.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 08/12/2015 01:37 PM, Stephen Frost wrote:
> Would be great to get comments on the other comments, specifically that
> adding SCRAM's password verifier won't seriously change the security of
> a user's account or password based on an attack vector where the
> contents of pg_authid is compromised.  I do agree with the general
> concern that the additional complexity involved in supporting multiple
> password verifiers may result in bugs, and likely security ones, but I
> really expect the larger risk to be from the SCRAM implementation itself
> than how we get data into and back out of our own catalogs.

There's also the concern that the additional complexity will cause
*users* to make security-compromising mistakes, which I think is the
greater risk.  Robert has mostly won me over to his point of view on this.

The only case where I can see multiple verifiers per role making a real
difference in migrations is for PGAAS hosting.  But the folks from
Heroku and AWS have been notably silent on this; lemme ping them.

-- 
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (77+ messages)  latest in thread

Message-ID: <55CBB8D5.7040501@agliodbs.com>
Permalink:  ../55CBB8D5.7040501@agliodbs.com/
Also on:    postgresql.org/message-id/55CBB8D5.7040501@agliodbs.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: josh@agliodbs.com, sfrost@snowman.net, robertmhaas@gmail.com, peter_e@gmx.net, hlinnaka@iki.fi, michael.paquier@gmail.com
  Subject: Re: WIP: SCRAM authentication
  In-Reply-To: <55CBB8D5.7040501@agliodbs.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox