1

When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the database.

I can't find in any document how this password is stored. Is it encrypted? Saved under Windows protection? Plain text?

Does anyone knows the security implications of saving a database password in pgAdmin?

3

In pgAdmin 4.x the password file location can be specified in GUI whereas pgAdmin III has a fixed path. Both documentations refers to the PostgreSQL libpq (C Library) documentation for The Password File:

The file .pgpass in a user's home directory can contain passwords to be used if the connection requires a password (and no password has been specified otherwise). On Microsoft Windows the file is named %APPDATA%\postgresql\pgpass.conf. Alternatively, a password file can be specified using the connection parameter passfile or the environment variable PGPASSFILE.

This file should contain lines of the following format:

hostname:port:database:username:password

TL;DR: It's unencrypted in a file.

  • Hmm disappointing, thanks! – mFeinstein Apr 15 at 4:42
  • In general, if a program can read it, then anything with the same privileges can read it, even if it's encrypted. For example AACS was based on false assumption that an encryption key could stay secret while it has to be used on every device. – Esa Jokinen Apr 15 at 4:48
  • Well, I am no expert on it, but I think windows and other OS have mechanisms to store secrets for programs. So only that program (and admin accounts) will have access to those secrets. So I was kinda counting on it – mFeinstein Apr 15 at 4:58
  • I think it's in a DB for PgAdmin 4: dba.stackexchange.com/a/193093/16892 – rogerdpack Aug 22 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.