3 ms·

I may have voted this comment up, but it makes me feel very :( Related, the only hashing algorithm supported by postgresql for authenticating to the pgsql serv

• mercurial 12y ago
  Let's see: > If you are at all concerned about password "sniffing" attacks then md5 is preferred. Plain password should always be avoided if possible. However, md5 cannot be used with the db_user_namespace feature. If the connection is protected by SSL encryption then password can be used safely (though SSL certificate authentication might be a better choice if one is depending on using SSL). Strongly implies that md5sum offers protection from an attacker sophisticated enough to sniff passwords of the network. Snif.
• marcosdumay 12y ago
  Take a look at the docs. MD5 is an option for network transportation of the password - almost the entire world transports it in plain text. It's a "you are doing it wrong if you need this, but it won't hurt if you don't need - so we'll keep it" feature, with the correct recomendation (using SSL) made all around. Anyway, the password will be stored in plain-text just a few servers away. It has to be. Whatever hash they use, hashing it will be as useless.