Hi all, I'm posting this to the list, since it seems to be making the rounds finally :) The "pass the hash" flaw and weak password hashing scheme in PostgreSQL was known to be weak at the time it was implemented. I was among a chorus of people who spoke out about it at the time of it's inclusion, but the developers' response boiled down to: http://marc.info/?l=postgresql-general&m=111414028609961&w=2 This was recently rediscovered by atom from hashcat: http://hashcat.net/forum/thread-4148.html To protect yourself: 1) Put "password" instead of "md5" in pg_hba.conf 2) Use a randomly generated, unique password rather than an actual word. 3) Don't let attackers see your pg_shadow The reason for (1) is that the password auth protocol doesn't accept hashes. Use TLS if network attacks are a problem. The reason for (2) - which is a good idea anyway - is because the hash in the database is is just md5(password username). If the username is "wordpress" for example, you could crack multiple hashes for similar cost to cracking one. (3) is a bit tongue-in-cheek, but pg_shadow is only accessible to superusers, so don't connect your webapp as a database superuser and you significantly reduce the risk of lots of bad stuff :) Regards, Michael