Re: Have an encrypted pgpass file

On Thu, Jul 19, 2018 at 9:52 AM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Thomas Munro <thomas(dot)munro(at)enterprisedb(dot)com> writes:
>> On Thu, Jul 19, 2018 at 5:46 AM, Marco van Eck <marco(dot)vaneck(at)gmail(dot)com> wrote:
>>> Since .pgpass files contain plain-text passwords, I searched for an
>>> alternative.
>>> In the attached patch I've added the possibility to run a command to produce
>>> the content of the pgpass file, in exactly the same format.
>
>> ... Here you side step those questions completely and make that the end
>> user's problem. I like it.
>
> ... but doesn't this just encourage people to build hacks that aren't
> really any more secure than the unreadable-file approach? In fact,
> I'm afraid this would be an attractive nuisance, in that people would
> build one-off hacks that get no security vetting and don't really work.
>
> I'd like to see a concrete example of a use-case that really does add
> security; preferably one short and useful enough to put into the docs
> so that people might copy-and-paste it rather than rolling their own.

+1

> It seems possible that something of the sort could be built atop
> ssh-agent or gpg-agent, for instance.

Another example would be the Apple keychain system. I think the
command would be something like "/usr/bin/security
find-generic-password -a someaccount -s somekeychain -w", and you'd
have to have stored it with something like "/usr/bin/security
add-generic-password -a someaccount -s somekeychain -w".

--
Thomas Munro
http://www.enterprisedb.com