Vince Vielhaber <vev@michvhf.com> writes:
> By knowing what PG will do with the username and random salt, sniffing
> the wire can make guessing the password trivial.
Not if the wire protocol is done correctly, ie, passwords are only
sent in hashed form.
regards, tom lane
