Re: Re: Encrypting pg_shadow passwords

"Frank Ch. Eigler" <fche@redhat.com> writes:
> Having scanned over the discussion again, my understanding is that Jim's
> proposed changes don't affect backwards compatibility.  As long as user
> passwords continue to be passed in plaintext to the server, the server
> can store encrypted passwords in the authentication table.

The 'passwd' mode wouldn't be affected, but the 'crypt' mode would be;
it would become less secure than it is now, because the server would be
forced to send the same salt always, and so a captured encrypted
password would be just as useful as a captured plaintext one.  That's
the step backwards.
        regards, tom lane