Subject: Re: pg_authid.rolpassword format (was Re: Password
 identifiers, protocol aging and SCRAM protocol)
To: Stephen Frost <sfrost@snowman.net>, Heikki Linnakangas <hlinnaka@iki.fi>
References: 
 <CAB7nPqSqEwRgmVCS_OW3sJn6baymQ6MsO3kKMRvHLC0RZaKaYA@mail.gmail.com>
 <21eecdb8-365b-8347-1ae2-5278d1fe798c@iki.fi>
 <CAB7nPqT2UGWm0ukdomC+mG-co6nmKer62vuSGRxwtc+jS8uQPA@mail.gmail.com>
 <CAB7nPqQtD7jOpYCsB4Ga=Cz+tgh4Ngac6NAV-WLs9zxaw0Uu7w@mail.gmail.com>
 <762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi>
 <CAB7nPqTi5jC_AbVMOGidrVy1z6t3v==vWFvdNMxnQEN-WsutKg@mail.gmail.com>
 <2d07165c-1793-e243-a2a9-e45b624c7580@iki.fi>
 <CABUevEyi7uw41nzyFRh2xUzB6uOh-QmavcwDMhW0jCTTe4KavQ@mail.gmail.com>
 <20161214181205.GB23459@momjian.us>
 <1D2394E9-B6F3-4EBB-B1CE-F84FCE49AEAE@iki.fi>
 <20161214194141.GU23417@tamriel.snowman.net>
Cc: Bruce Momjian <bruce@momjian.us>, Magnus Hagander <magnus@hagander.net>,
 Michael Paquier <michael.paquier@gmail.com>,
 Robert Haas <robertmhaas@gmail.com>, Andres Freund <andres@anarazel.de>,
 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
 David Steele <david@pgmasters.net>, Tom Lane <tgl@sss.pgh.pa.us>,
 David Fetter <david@fetter.org>, Alvaro Herrera <alvherre@2ndquadrant.com>,
 Julian Markwort <julian.markwort@uni-muenster.de>,
 PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
 Valery Popov <v.popov@postgrespro.ru>
From: "Joshua D. Drake" <jd@commandprompt.com>
Organization: Command Prompt, Inc.
Message-ID: <708b944a-46cf-12c6-711b-ec6280946162@commandprompt.com>
Date: Wed, 14 Dec 2016 11:58:51 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.5.1
MIME-Version: 1.0
In-Reply-To: <20161214194141.GU23417@tamriel.snowman.net>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 12/14/2016 11:41 AM, Stephen Frost wrote:
> * Heikki Linnakangas (hlinnaka@iki.fi) wrote:
>> On 14 December 2016 20:12:05 EET, Bruce Momjian <bruce@momjian.us> wrote:
>>> On Wed, Dec 14, 2016 at 11:27:15AM +0100, Magnus Hagander wrote:

> Storing plaintext passwords has been bad form for just about forever and
> I wouldn't be sad to see our support of it go.  At the least, as was
> discussed somewhere, but I'm not sure where it ended up, we should give
> administrators the ability to control what ways a password can be
> stored.  In particular, once a user has migrated all of their users to
> SCRAM, they should be able to say "don't let new passwords be in any
> format other than SCRAM-SHA-256".

It isn't as bad as it used to be. I remember with PASSWORD was the 
default. I agree that we should be able to set a policy that says, "we 
only allow X for password storage".

JD


>
> Thanks!
>
> Stephen
>


-- 
Command Prompt, Inc.                  http://the.postgres.company/
                         +1-503-667-4564
PostgreSQL Centered full stack support, consulting and development.
Everyone appreciates your honesty, until you are honest with them.


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers