From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael.paquier@gmail.com>
cc: Robert Haas <robertmhaas@gmail.com>, Jeff Janes <jeff.janes@gmail.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: scram and \password
In-reply-to: 
 <CAB7nPqTUBYwPfr4o5z+petZ+94ymGRjev1U7x0xdA8zruqtRXg@mail.gmail.com>
References: 
 <CAMkU=1wfBgFPbfAMYZQE78p=VhZX7nN86aWkp0QcCp=+KxZ=bg@mail.gmail.com>
 <CAB7nPqSELwmfwgOt8U_rK15sHWuGeLhsWYihRtq9ADC3MZ=HTg@mail.gmail.com>
 <CA+TgmoY3VmPTn8gaKhx2fXXiMX_U2Ozf3qMXyVa+zsuMMox1HA@mail.gmail.com>
 <CAB7nPqTZNZkbezTZ3WrTBU42cAuAGjyukJAs=iw=KN4GZGoXxA@mail.gmail.com>
 <CA+TgmoYHvtOYex0N0DTm3hAvgZezZZpH789a13MzHDh_VgG9Ew@mail.gmail.com>
 <29551.1489459676@sss.pgh.pa.us>
 <CAB7nPqTUBYwPfr4o5z+petZ+94ymGRjev1U7x0xdA8zruqtRXg@mail.gmail.com>
Comments: In-reply-to Michael Paquier <michael.paquier@gmail.com>
	message dated "Tue, 14 Mar 2017 12:20:47 +0900"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <742.1489462454.1@sss.pgh.pa.us>
Date: Mon, 13 Mar 2017 23:34:14 -0400
Message-ID: <743.1489462454@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

Michael Paquier <michael.paquier@gmail.com> writes:
> On Tue, Mar 14, 2017 at 11:47 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Seems to me the intended behavior of \password is to use the best
>> available practice.  So my guess is that it ought to use SCRAM when
>> talking to a >= 10.0 server.  What the previous password was ought
>> to be irrelevant, even if it could find that out which it shouldn't
>> be able to IMO.

> And in a release or two? SCRAM being a fresh feature, switching the
> hashing now is not much a conservative approach.

If some other practice becomes better in v12, then we teach it about that
one.  It's not like psql hasn't got many other server-version-dependent
behaviors.

Alternatively, if what you mean by that is you don't trust SCRAM at all,
maybe we'd better revert the feature as not being ready for prime time.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers