From: Michael Graff <explorer@flame.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: M.Boekhold@ET.TUDelft.NL
Cc: pgsql-hackers@postgreSQL.org
Cc: pgsql-interfaces@postgreSQL.org
Cc: pgsql-patches@postgreSQL.org
Subject: Re: [PATCHES] Re: [HACKERS] User authentication bug?
Date: 02 Aug 1998 12:54:57 -0700
Message-ID: <v6d8ajw44u.fsf@kechara.lh.vix.com> (raw)
References: <19626.902020817@sss.pgh.pa.us>
Tom Lane <tgl@sss.pgh.pa.us> writes:
> With the attached patch, I have verified that long (> 8char anyway)
> usernames and passwords work correctly in both "password" and "crypt"
> authorization mode. NOTE: at least on my machine, it seems that the
> crypt() routines ignore the part of the password beyond 8 characters,
> so there's no security gain from longer passwords in crypt auth mode.
> But they don't fail.
Which is why postgres should use MD5, salted with the username, as a
password one-way hash. :)
--Michael
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: explorer@flame.org, tgl@sss.pgh.pa.us, M.Boekhold@ET.TUDelft.NL, pgsql-hackers@postgreSQL.org, pgsql-patches@postgreSQL.org
Subject: Re: [PATCHES] Re: [HACKERS] User authentication bug?
In-Reply-To: <v6d8ajw44u.fsf@kechara.lh.vix.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox