From: | Jeff Janes <jeff(dot)janes(at)gmail(dot)com> |
---|---|
To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
Cc: | Thomas Munro <thomas(dot)munro(at)enterprisedb(dot)com>, Marco van Eck <marco(dot)vaneck(at)gmail(dot)com>, Pg Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Have an encrypted pgpass file |
Date: | 2018-07-23 21:53:55 |
Message-ID: | CAMkU=1z1h1Yq3EJ9+501Om==mXsFNabZ6x744B1S_8EjJHx_Sw@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Wed, Jul 18, 2018 at 5:52 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Thomas Munro <thomas(dot)munro(at)enterprisedb(dot)com> writes:
> > On Thu, Jul 19, 2018 at 5:46 AM, Marco van Eck <marco(dot)vaneck(at)gmail(dot)com>
> wrote:
> >> Since .pgpass files contain plain-text passwords, I searched for an
> >> alternative.
> >> In the attached patch I've added the possibility to run a command to
> produce
> >> the content of the pgpass file, in exactly the same format.
>
> > ... Here you side step those questions completely and make that the end
> > user's problem. I like it.
>
> ... but doesn't this just encourage people to build hacks that aren't
> really any more secure than the unreadable-file approach? In fact,
> I'm afraid this would be an attractive nuisance, in that people would
> build one-off hacks that get no security vetting and don't really work.
>
> I'd like to see a concrete example of a use-case that really does add
> security; preferably one short and useful enough to put into the docs
> so that people might copy-and-paste it rather than rolling their own.
> It seems possible that something of the sort could be built atop
> ssh-agent or gpg-agent, for instance.
>
If the goal is not unattended operation but just unannoying operation, I
think the first example he provided is already that use-case. If you
already have gpg configured to use gpg-agent, then it just works. You get
encryption-at-rest, and you don't have to type in your password repeatedly
in the same continuous shell session.
Cheers,
Jeff
From | Date | Subject | |
---|---|---|---|
Next Message | Kefan Yang | 2018-07-23 22:21:01 | RE: GSOC 2018 Project - A New Sorting Routine |
Previous Message | Peter Eisentraut | 2018-07-23 21:04:21 | Re: Stored procedures and out parameters |