| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Tomasz Ostrowski <tometzky(at)batory(dot)org(dot)pl> |
| Cc: | Lexington Luthor <Lexington(dot)Luthor(at)gmail(dot)com>, pgsql-general(at)postgresql(dot)org |
| Subject: | Re: Generating unique session ids |
| Date: | 2006-07-27 13:39:40 |
| Message-ID: | 6193.1154007580@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-general |
Tomasz Ostrowski <tometzky(at)batory(dot)org(dot)pl> writes:
> * When somebody knows md5('secret_salt' || '5') he will be able to
> easily compute
> md5('secret_salt' || '50')
> md5('secret_salt' || '51')
Sure, but can't you fix that by putting the secret part at the end?
> * PostgreSQL integers (as returned by nextval()) are 4 bytes. This
> means only 32 bit strength - much too low for today computers.
Um, nextval returns int8.
> * Any database user is most of the time able to read function
> bodies, so anybody who is able co connect to your database will be
> able to get your 'secret_salt' and then predict session id's.
Yeah, it's not clear where to hide the secret.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Alvaro Herrera | 2006-07-27 13:55:21 | Re: Generating unique session ids |
| Previous Message | Chris Mair | 2006-07-27 13:34:16 | Re: Generating unique session ids |