Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1ZPdSv-0003of-Or for pgsql-hackers@arkaria.postgresql.org; Wed, 12 Aug 2015 21:21:41 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84) (envelope-from ) id 1ZPdSv-0002aI-5y for pgsql-hackers@arkaria.postgresql.org; Wed, 12 Aug 2015 21:21:41 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZPdSt-0002a9-Jn for pgsql-hackers@postgresql.org; Wed, 12 Aug 2015 21:21:39 +0000 Received: from 01.zmailcloud.com ([192.198.85.104] helo=mx-out-1.zmailcloud.com) by magus.postgresql.org with esmtp (Exim 4.84) (envelope-from ) id 1ZPdSk-0004WO-Nn for pgsql-hackers@postgresql.org; Wed, 12 Aug 2015 21:21:38 +0000 Received: from smtp.01.com (smtp.01.com [10.10.0.43]) by mx-out-1.zmailcloud.com (Postfix) with ESMTP id 9163856B786; Wed, 12 Aug 2015 16:21:28 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 7DDB660C25; Wed, 12 Aug 2015 16:21:28 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-2.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-2.01.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B9LJ5CZYwk9W; Wed, 12 Aug 2015 16:21:28 -0500 (CDT) Received: from smtp.01.com (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 4AE6160C29; Wed, 12 Aug 2015 16:21:28 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 342BA60C28; Wed, 12 Aug 2015 16:21:28 -0500 (CDT) X-Virus-Scanned: amavisd-new at smtp-out-2.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-2.01.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id vISlx8NZhdfo; Wed, 12 Aug 2015 16:21:28 -0500 (CDT) Received: from [172.47.23.104] (50-0-190-244.dsl.dynamic.fusionbroadband.com [50.0.190.244]) by smtp-out-2.01.com (Postfix) with ESMTPSA id 4559D60C25; Wed, 12 Aug 2015 16:21:26 -0500 (CDT) Message-ID: <55CBB8D5.7040501@agliodbs.com> Date: Wed, 12 Aug 2015 14:21:25 -0700 From: Josh Berkus Organization: PostgreSQL Experts Inc. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0 MIME-Version: 1.0 To: Stephen Frost , Robert Haas CC: Peter Eisentraut , Heikki Linnakangas , Michael Paquier , pgsql-hackers Subject: Re: WIP: SCRAM authentication References: <55C79F0A.90601@agliodbs.com> <55CA4085.30101@gmx.net> <55CB5D38.5090503@gmx.net> <55CBA425.5070803@gmx.net> <20150812200938.GM3685@tamriel.snowman.net> <20150812203732.GN3685@tamriel.snowman.net> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 08/12/2015 01:37 PM, Stephen Frost wrote: > Would be great to get comments on the other comments, specifically that > adding SCRAM's password verifier won't seriously change the security of > a user's account or password based on an attack vector where the > contents of pg_authid is compromised. I do agree with the general > concern that the additional complexity involved in supporting multiple > password verifiers may result in bugs, and likely security ones, but I > really expect the larger risk to be from the SCRAM implementation itself > than how we get data into and back out of our own catalogs. There's also the concern that the additional complexity will cause *users* to make security-compromising mistakes, which I think is the greater risk. Robert has mostly won me over to his point of view on this. The only case where I can see multiple verifiers per role making a real difference in migrations is for PGAAS hosting. But the folks from Heroku and AWS have been notably silent on this; lemme ping them. -- Josh Berkus PostgreSQL Experts Inc. http://pgexperts.com -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers