4 ms·

I see that MySQL's documentation [1] recommends SHA2: > Exploits for the MD5 and SHA-1 algorithms have become known. You may wish to consider using one of the

I see that MySQL's documentation [1] recommends SHA2: > Exploits for the MD5 and SHA-1 algorithms have become known. You may wish to consider using one of the other encryption functions described in this section instead, such as SHA2(). Further down: > The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see RFC 2195, section 2 (Challenge-Response Authentication Mechanism (CRAM)), for more information about handling passwords and authentication securely in your applications. 1: http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_password http://dev.mysql.com/doc/refman/5.5/en/encryption-functions....

sarciszewski 12y ago
I may have voted this comment up, but it makes me feel very :( Related, the only hashing algorithm supported by postgresql for authenticating to the pgsql server is md5.
- mercurial 12y ago
  Let's see: > If you are at all concerned about password "sniffing" attacks then md5 is preferred. Plain password should always be avoided if possible. However, md5 cannot be used with the db_user_namespace feature. If the connection is protected by SSL encryption then password can be used safely (though SSL certificate authentication might be a better choice if one is depending on using SSL). Strongly implies that md5sum offers protection from an attacker sophisticated enough to sniff passwords of the network. Snif.
- marcosdumay 12y ago
  Take a look at the docs. MD5 is an option for network transportation of the password - almost the entire world transports it in plain text. It's a "you are doing it wrong if you need this, but it won't hurt if you don't need - so we'll keep it" feature, with the correct recomendation (using SSL) made all around. Anyway, the password will be stored in plain-text just a few servers away. It has to be. Whatever hash they use, hashing it will be as useless.

sarciszewski 12y ago

I may have voted this comment up, but it makes me feel very :( Related, the only hashing algorithm supported by postgresql for authenticating to the pgsql server is md5.

mercurial 12y ago
Let's see: > If you are at all concerned about password "sniffing" attacks then md5 is preferred. Plain password should always be avoided if possible. However, md5 cannot be used with the db_user_namespace feature. If the connection is protected by SSL encryption then password can be used safely (though SSL certificate authentication might be a better choice if one is depending on using SSL). Strongly implies that md5sum offers protection from an attacker sophisticated enough to sniff passwords of the network. Snif.
marcosdumay 12y ago
Take a look at the docs. MD5 is an option for network transportation of the password - almost the entire world transports it in plain text. It's a "you are doing it wrong if you need this, but it won't hurt if you don't need - so we'll keep it" feature, with the correct recomendation (using SSL) made all around. Anyway, the password will be stored in plain-text just a few servers away. It has to be. Whatever hash they use, hashing it will be as useless.