Re: Rejecting weak passwords

Tom Lane wrote:
> "Albe Laurenz" <laurenz.albe@wien.gv.at> writes:
> > Bruce Momjian wrote:
> >> Password checks might include password complexity or non-reuse of
> >> passwords. This facility will require the client to send the password to
> >> the server in plain-text, so SSL and 'password' authentication is
> >> necessary to use this features.
> 
> > So in my opinion that should be:
> > This facility will require to send new and changed password to
> > the server in plain-text, so it will require SSL, and the use
> > of encrypted passwords in CREATE/ALTER ROLE will have to be
> > disabled.
> 
> Actually, not one word of *either* version should be in TODO.  All of
> that is speculation about policies that a particular add-on module
> might or might not choose to enforce.

Agreed, updated:

	|Allow server-side enforcement of password policies
	|Password checks might include password complexity or non-reuse of
	passwords.  This facility will require the client to send password
	creation/changes to the server in plain-text, not MD5.

-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + If your life is a hard drive, Christ can be your backup. +