Em Monday 03 March 2008 13:17:03 você escreveu:
>
> My understanding is no password is sent in the clear with md5 per:
>
> http://www.postgresql.org/docs/8.3/interactive/auth-methods.html#AUTH-PASSW
>ORD
But the MD5 hash is. This page states that the password can't be directly
sniffed, but one can still get the hash of the password and perform a
dictionary attack against it on a local copy (i.e., without ever trying to
connect to the server).
After a successful attack then one can connect directly to the server as if
the password was known to him/her.
Crypting the channell -- be it with SSL or SSH, for example -- will prevent
the sniffer from being able to capture the hash, so your password will be
safer.
--
Jorge Godoy <jgodoy@gmail.com>
