From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter_e@gmx.net>
Cc: Tom Samplonius <tom@sdf.com>
Cc: Cedar Cox <cedarc@visionforisrael.com>
Cc: George P. Esperanza <george@calamba.laguna.net>
Cc: pgsql-interfaces@postgresql.org
Subject: Re: ODBC problem
Date: Mon, 09 Oct 2000 12:45:36 -0400
Message-ID: <25669.971109936@sss.pgh.pa.us> (raw)
In-Reply-To: <Pine.LNX.4.21.0010091831330.856-100000@peter.localdomain>
References: <Pine.LNX.4.21.0010091831330.856-100000@peter.localdomain>
Peter Eisentraut <peter_e@gmx.net> writes:
> Tom Samplonius writes:
>> Except for the fact that crypt provides little if no security increase.
>> Even though only a crypted password is sent over the wire, that crypted
>> password can still be captured off the wire and replayed to get access.
> Only if you happen to get the same salt from the server every time, which
> is rather unlikely.
However, the standard crypt algorithm only has a small number of
distinct salt values, so an attacker who's sniffed one login transaction
can connect repeatedly until challenged with the same salt he saw used
before.
We have talked about adding a higher-security login protocol --- you can
find past threads about this in the pghackers archive. IIRC a fairly
complete design was worked out, but no one's got round to implementing
it yet. There might still have been some unresolved objections, too.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: tgl@sss.pgh.pa.us, peter_e@gmx.net, tom@sdf.com, cedarc@visionforisrael.com, george@calamba.laguna.net
Subject: Re: ODBC problem
In-Reply-To: <25669.971109936@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox