Received: from kechara.flame.org (kechara.lh.vix.com [204.152.188.21]) by hub.org (8.8.8/8.7.5) with SMTP id PAA00118 for ; Sun, 2 Aug 1998 15:55:35 -0400 (EDT) Received: (qmail 21216 invoked by uid 173); 2 Aug 1998 19:54:58 -0000 Sender: explorer@kechara.lh.vix.com To: Tom Lane Cc: M.Boekhold@ET.TUDelft.NL, pgsql-hackers@postgreSQL.org, pgsql-interfaces@postgreSQL.org, pgsql-patches@postgreSQL.org Subject: Re: [PATCHES] Re: [HACKERS] User authentication bug? References: <19626.902020817@sss.pgh.pa.us> From: Michael Graff Date: 02 Aug 1998 12:54:57 -0700 In-Reply-To: Tom Lane's message of Sat, 01 Aug 1998 21:20:17 -0400 Message-ID: Lines: 13 X-Mailer: Gnus v5.4.37/Emacs 20.2 Tom Lane writes: > With the attached patch, I have verified that long (> 8char anyway) > usernames and passwords work correctly in both "password" and "crypt" > authorization mode. NOTE: at least on my machine, it seems that the > crypt() routines ignore the part of the password beyond 8 characters, > so there's no security gain from longer passwords in crypt auth mode. > But they don't fail. Which is why postgres should use MD5, salted with the username, as a password one-way hash. :) --Michael