Re: Salt in encrypted password in pg_shadow - Mailing list pgsql-general

David Garamond wrote:
> Consider someone who creates a long list of:
>
>  MD5( "postgres" + "aaaaaaaa" )
>  MD5( "postgres" + "aaaaaaab" )
>  MD5( "postgres" + "aaaaaaac" )
>  ...
>
> Now if he has access to other people's pg_shadow, he can compare the
> hashes with his dictionary. Replacing "postgres" with a random salt
> defeats this dictionary attack (and thus he will have to resort to brute
> force).

But surely you have to store the random salt in pg_shadow too? Or am I
missing something?

--
   Richard Huxton
   Archonet Ltd