Robert Haas <robertmhaas(at)gmail(dot)com> writes:
> On Sun, Dec 20, 2015 at 1:47 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> The syntax you propose exposes the user's password in cleartext in
>> the command, where it is likely to get captured in logs for example.
>> That's not going to do.
> Of course, right now, the ALTER USER ... PASSWORD command has that
> problem which is, uh, bad.
Which is why we invented the ENCRYPTED PASSWORD syntax, as well as
psql's \password command ... but using that approach for actual
login to an account would be a security fail as well.
regards, tom lane