Re: md5 again

Bruce Momjian <pgman@candle.pha.pa.us> writes:
> MD5(MD5(username+user_salt)+random_salt)

> Postmaster takes its pg_shadow MD5(username+user_salt) and does another
> MD5 with the random salt and compares it with what was sent from the
> client.

Doesn't seem quite right ... where's the password?
        regards, tom lane