X-Original-To: pgsql-interfaces-postgresql.org@localhost.postgresql.org Received: from localhost (mx1.hub.org [200.46.208.251]) by postgresql.org (Postfix) with ESMTP id 43F2E9FA5F0 for ; Tue, 30 May 2006 20:02:17 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.208.251]) (amavisd-new, port 10024) with ESMTP id 30399-01 for ; Tue, 30 May 2006 20:02:12 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey- Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by postgresql.org (Postfix) with ESMTP id B074A9FA5E9 for ; Tue, 30 May 2006 20:02:12 -0300 (ADT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.13.6/8.13.6) with ESMTP id k4UN2BBb004869; Tue, 30 May 2006 19:02:11 -0400 (EDT) To: Fernando Grijalba cc: pgsql-interfaces@postgresql.org Subject: Re: Reset expired password from .NET In-reply-to: <20060530204828.59520.qmail@web88203.mail.re2.yahoo.com> References: <20060530204828.59520.qmail@web88203.mail.re2.yahoo.com> Comments: In-reply-to Fernando Grijalba message dated "Tue, 30 May 2006 13:48:28 -0700" Date: Tue, 30 May 2006 19:02:11 -0400 Message-ID: <4868.1149030131@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200605/17 X-Sequence-Number: 6138 Fernando Grijalba writes: > I just realized that Postgresql does not differentiate between an invalid username/password or an expired password when it gives you the error message. That's intentional. Per the comments in auth.c: * Tell the user the authentication failed, but not (much about) why. * * There is a tradeoff here between security concerns and making life * unnecessarily difficult for legitimate users. We would not, for example, * want to report the password we were expecting to receive... * But it seems useful to report the username and authorization method * in use, and these are items that must be presumed known to an attacker * anyway. * Note that many sorts of failure report additional information in the * postmaster log, which we hope is only readable by good guys. regards, tom lane