Postgres Pro
Downloads
Home   >   mailing lists

Re: [HACKERS] SCRAM authentication, take three - Mailing list pgsql-hackers

From Robert Haas
Subject Re: [HACKERS] SCRAM authentication, take three
Date
Msg-id CA+Tgmoa3krDpm8AihBi69A7Ju0Nt_JBdej9n4sC3J6MoG63w-g@mail.gmail.com
Whole thread Raw
In response to Re: [HACKERS] SCRAM authentication, take three  (Heikki Linnakangas <hlinnaka@iki.fi>)
Responses Re: [HACKERS] SCRAM authentication, take three  (Michael Paquier <michael.paquier@gmail.com>)
List pgsql-hackers
Tree view 
On Fri, Apr 7, 2017 at 3:59 AM, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
> I think the "SCRAM" part is more important than "SHA-256", so -1 on that.

I agree.  The point here isn't that we're using a better hashing
method, even if a lot of people *think* that's the point.  The point
is we're using a modern algorithm that has nice properties like "you
can't impersonate the client by steeling the verifier, or even by
snooping the exchange".

But "sasl" might be even better.

-- 
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

pgsql-hackers by date:

Previous
From: Jeff Janes
Date:
Subject: [HACKERS] pgbench --progress-timestamp no longer works correctly
Next
From: Andrew Dunstan
Date:
Subject: Re: [HACKERS] recent deadlock regression test failures