Re: Rejecting weak passwords

On Thu, Oct 15, 2009 at 6:55 PM, Robert Haas <robertmhaas@gmail.com> wrote:

> OK, so we're in violent agreement here?

From a technical perspective I think we have been for a while. Though
clearly some people disagree with my assertion that putting any form
of policy enforcement in the client is not actually 'enforcement'. I
wonder how many of those folks would implement their website's data
sanitisation in the browser only - but I digress... :-)

> Except for figuring out how
> an API for checking the flag?  Could they just try it with MD5 first
> and then fall back if that say "no MD5"?

That's what I was trying to avoid, as the architecture of pgAdmin
makes that really hard. I know that's not PG's problem, but forcing a
retry is quite an ugly solution anyway, so I was hoping we could come
up with something better.

I suppose in the worst case, I could just have pgAdmin throw the
error, and then add a per-server option to disable password hashing in
the relevant places, but I'd far rather have that automated so it
can't be set unnecessarily.

--
Dave Page
EnterpriseDB UK:   http://www.enterprisedb.com