Re: passwordcheck module problem

Hi,

First, please note that this mailing list is for reporting issues 
related to the web properties of PostgreSQL. For general discussion 
items, please use pgsql-general@

On 2/15/24 7:20 AM, Zaur Hajili wrote:
> Hi,
> 
> recently one of dba course students informed me about problem of 
> passwordcheck module.
> 
> I cannot imagine that it is not a known issue, but if this is the known 
> issue, then passwordcheck module loses all its functionality.
> 
> Problem is, when a user changes its password via*\password *(psql meta 
> command) command, it can set any simple password successfuly.
> 
> Tested in versions 14,15,16. same behavior.

You're seeing the SCRAM hash, which is due to switch to using SCRAM as 
the default hashing method from PostgreSQL 14+. Prior to that, it was 
md5, which would still generate a md5 hash using \password.

> Postgres must check the password before converting to hash, it is clear 
> that after hash it cannot detect the weakness.

This can get into a long debate about the value of checking the strength 
of a plaintext password by enforced requirements. However, with a hash, 
you can still check if the hashed password is in a common dictionary of 
passwords with the tradeoff that this computation can take some time 
depending on how large the dictionary is.

Thanks,

Jonathan