On Thu, Jul 19, 2018 at 9:52 AM, Tom Lane <t...@sss.pgh.pa.us> wrote: > Thomas Munro <thomas.mu...@enterprisedb.com> writes: >> On Thu, Jul 19, 2018 at 5:46 AM, Marco van Eck <marco.van...@gmail.com> >> wrote: >>> Since .pgpass files contain plain-text passwords, I searched for an >>> alternative. >>> In the attached patch I've added the possibility to run a command to produce >>> the content of the pgpass file, in exactly the same format. > >> ... Here you side step those questions completely and make that the end >> user's problem. I like it. > > ... but doesn't this just encourage people to build hacks that aren't > really any more secure than the unreadable-file approach? In fact, > I'm afraid this would be an attractive nuisance, in that people would > build one-off hacks that get no security vetting and don't really work. > > I'd like to see a concrete example of a use-case that really does add > security; preferably one short and useful enough to put into the docs > so that people might copy-and-paste it rather than rolling their own.
+1 > It seems possible that something of the sort could be built atop > ssh-agent or gpg-agent, for instance. Another example would be the Apple keychain system. I think the command would be something like "/usr/bin/security find-generic-password -a someaccount -s somekeychain -w", and you'd have to have stored it with something like "/usr/bin/security add-generic-password -a someaccount -s somekeychain -w". -- Thomas Munro http://www.enterprisedb.com
