On 02.03.22 15:16, Jonathan S. Katz wrote:
What are the reasons they are still purposely using it? The ones I have
seen/heard are:
- Using an older driver
- On a pre-v10 PG
- Unaware of SCRAM
Another reason is that SCRAM presents subtle operational issues in
distributed systems. As someone who is involved with products such as
pgbouncer and bdr, I am aware that there are still unresolved problems
and ongoing research in that area. Maybe they can all be solved
eventually, even if it is concluding "you can't do that anymore" in
certain cases, but it's not all solved yet, and falling back to the
best-method-before-this-one is a useful workaround.
I'm thinking there might be room for an authentication method between
plain and scram that is less complicated and allows distributed systems
to be set up more easily. I don't know what that would be, but I don't
think we should prohibit the consideration of "anything less than SCRAM".
I notice that a lot of internet services are promoting "application
passwords" nowadays. I don't know the implementation details of that,
but it appears that the overall idea is to have instead of one
high-value password have many frequently generated medium-value
passwords. We also have a recent proposal to store multiple passwords
per user. (Obviously that could apply to SCRAM and not-SCRAM equally.)
That's the kind of direction I would like to explore.
