Re: Encrypting pg_shadow passwords

> > The big problem is that when we make a change we have to also talk to
> > old clients to you would have a pretty complex setup to have 'password'
> > encryption passing the same crypt over the wire all the time. If not,
> > why not use 'crypt' authentication.
>
> i don't understand the objection to my mods.
>
> crypt authentication requires plain-text passwords stored in pg_shadow.
>
> my stand is that this is not a good idea.
>
> my mods in no way break any existing code, and add another variant on the
> existing auth schemes.
>
> i think that any evolution of the auth schemes should depreciate the older
> methods, but that backwards compatibility needs to be maintained, even
> if the code is disabled by default, and needs a --enable to turn it back on.

OK, your mods are going to have to propogate to all clients. Older
clients can't use this scheme, and once we have double-encryption, what
advantage does this have?

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 853-3000
+ If your life is a hard drive, | 830 Blythe Avenue
+ Christ can be your backup. | Drexel Hill, Pennsylvania 19026