Re: Password complexity/history - credcheck?

On 23/06/2024 01:23, Tom Lane wrote:

> Don't suppose it would help to push back on whether your security
> team knows what they're doing.
> ...
> Anyway, considerations like these are why there's not features
> of this sort in community PG.  You can use an extension that
> applies some checks, but there's no good way around the "needs
> cleartext password" problem for that.
>
>             regards, tom lane

I believe that our security team is getting most of this from our 
auditors, who seem convinced that minimal complexity, password history 
etc are the way to go despite the fact that, as you say, server-side 
password checks can't really be implemented when the database receives a 
hash rather than a clear text password and password minimal complexity 
etc is not perhaps considered the gold standard it once was.

In fact, I think they see a hashed password as a disadvantage.

credcheck seems to satisfy their requirements - password complexity, 
password history, etc but - and this is the crucial bit - only on 
cleartext passwords.

If I'm forced to go to cleartext passwords, which would be a nightmare, 
credcheck might be worth looking at, but I'm not sure whether or not it 
is well adopted, reliable, and without significant issues. I only heard 
about it a few days ago from a friend/colleague, so I was wondering if 
anybody else was using it and what experiences with it might be.

Regards,

Martin.

-- 
Martin Goodson.

"Have you thought up some clever plan, Doctor?"
"Yes, Jamie, I believe I have."
"What're you going to do?"
"Bung a rock at it."