Secure Your Web Webapp passwords in PostgreSQL
summary
Outlines a concrete design: rename the user table to a shadow table, revoke select on shadow from the web role, expose a trimmed view with nulled secrets, and implement a security definer function set (login, set_password, create/delete) that runs as the owner and calls create extension pgcrypto then gen_salt/crypt to store and verify hashes. Demonstrates this prevents bulk hash/email dumps and offline cracking while warning that insecure SQL inside security-definer functions becomes the new attack surface.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:10What is this talk about
- 1:41The typical web application
- 1:53You get hacked
- 2:50Hashed passwords
- 3:17Hashed passwords only help against hacks
- 4:30We can easily do things about this
- 5:00User table
- 5:38SQL injection attack
- 6:23History of passwords
- 11:37Web user permissions
- 12:31Database encryption and hashing
- 14:26Login
- 18:44Password Generation
- 20:42Limitations
- 21:44Security Definer
related talks
40mPostgreSQL Security for Application Developers
28mFrom Dev to Prod: Securing Postgres the Right Way
50mSecuring PostgreSQL
07mAll about Postgres security
32mEnhancing Security in PostgreSQL
44mWho's managing the credentials for your database?
35mSecuring PostgreSQL From External Attack
55mGet Your Insecure PostgreSQL Passwords to SCRAM!