News for hackers. Stuff that matters.
Re:Securing a Postgres Database by koolba on Friday April 02, 2021 @05:44PM (#26676303)
Running a slow hash operation that should take a non-negligible amount of CPU on your single core per process database server isn’t a great idea.

That’s not a rag on stored procedures more generally. Just that specific use case scales poorly to a large number of operations as its inherently cpu bound.

Re:Securing a Postgres Database by tpetry on Saturday April 03, 2021 @02:49AM (#26678862)
You can do the slow pbkdf2 hash on your webserver and use the result for your stored procedure to check the password. If the password column is only visible to the stored procedure you have used the best features of both systems.
Re:Securing a Postgres Database by koolba on Saturday April 03, 2021 @06:24AM (#26679799)
No you can’t. To do the hash you need the per user salt before you start hashing. Which would require reading from the DB.
Re:Securing a Postgres Database by mvolfik on Saturday April 03, 2021 @07:19AM (#26680073)
Then you can retrieve salt, do hash on server, and use the stored procedure to compare. More requests, but a tradeoff for security \o/
Re:Securing a Postgres Database by tpetry on Monday April 05, 2021 @04:46AM (#26696676)
There is no reason you can‘t have a deterministic function which generates a hash for the user.

A simple sha256(lower(email)) is equally secure as a complete random salt, the only requirement on a salt is to be unique.