Re: BUG #8628: md5 security hole

rob@northleaf.com writes:
> I am able to login without a password when the password field is null.

Works as expected for me.  Typically, when people complain that password
auth is unexpectedly letting them in, it's because the server isn't
actually using the pg_hba.conf setting they think it is (don't forget to
SIGHUP or restart the postmaster after editing that file), or they have
a ~/.pgpass file that's supplying the password for them.

            regards, tom lane