Mark Mielke wrote:
> In any case, this is all irrelevant, because md5 passwords are still
> very useful, and the argument that "more = better" is a never ending
> infinite resource trap. More is not better. Better is better. If you can
> prove md5 is insufficient for PostgreSQL passwords, the correct decision
> would be to switch to something better, and deprecate md5 from the core.
Agreed.
One must also remember that if you use two hashes, if *either* one of
them is broken in the future so that you can reconstruct the password
from the hash, you're screwed.
-- Heikki Linnakangas EnterpriseDB http://www.enterprisedb.com