On Wed, Jun 24, 2026 at 07:43:21AM -0700, Jacob Champion wrote:
> Presumably the verifier was created a while back, though, in the case
> of an upgrade. Personally I think it makes sense to warn whenever the
> MD5 hash is used to authenticate.
I'm fine with expanding the warnings to "password" auth. Something else I
considered is whether we should warn if a role with an MD5 password is
authenticated without using the password. I ultimately decided against
that, but we could expand it there, too.
> No opinion on the patch implementation, though (cc'd Nathan who might?).
TBH I'm not too opinionated here, if for no other reason than all this code
should be getting deleted in the next couple of years.
--
nathan
