Re: Encrypting pg_shadow passwords

> > The big problem is that when we make a change we have to also talk to
> > old clients to you would have a pretty complex setup to have 'password'
> > encryption passing the same crypt over the wire all the time.  If not,
> > why not use 'crypt' authentication.
> 
> i don't understand the objection to my mods.
> 
> crypt authentication requires plain-text passwords stored in pg_shadow.
> 
> my stand is that this is not a good idea.
> 
> my mods in no way break any existing code, and add another variant on the
> existing auth schemes.
> 
> i think that any evolution of the auth schemes should depreciate the older
> methods, but that backwards compatibility needs to be maintained, even
> if the code is disabled by default, and needs a --enable to turn it back on.

OK, your mods are going to have to propogate to all clients.  Older
clients can't use this scheme, and once we have double-encryption, what
advantage does this have?

--  Bruce Momjian                        |  http://candle.pha.pa.us pgman@candle.pha.pa.us               |  (610)
853-3000+  If your life is a hard drive,     |  830 Blythe Avenue +  Christ can be your backup.        |  Drexel Hill,
Pennsylvania19026