3

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server?

If I could see the password in plaintext using a tool like wireshark, does it mean that its because of poor implementation or its just the way JDBC works?

Can anyone give me an example with any db vendor? Say MySQL JDBC driver or Postgres JDBC driver?

2

2 Answers 2

3

JDBC is a Java API. It uses JDBC database drivers to actually communicate with database servers. These drivers may or may not support TLS.

The PostgreSQL JDBC driver supports TLS: https://jdbc.postgresql.org/documentation/94/ssl.html

So, it would connect to the database server using TLS, then send the username and password to authenticate. You would not be able to see the password using Wireshark.

PostgreSQL also supports "pass the (md5) hash" style authentication but it's not recommended. This would hash the password with md5 on the client and send it to the server.

1

This depends entirely on

1.how your jdbc application is written

  1. The options the JDBC vendor has provided for connection.

JDBC is capable of sending passwords in the plain and this can be seen in clear in the JDBC logs as well of such jdbc connections.

JDBC Vendors expose APIs that can overcome this using different methods of encryption and hashing. In other cases SSL/ TLS can be used. In this case entire communication will be encrypted not just the password

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.