On Fri, Nov 21, 2025 at 11:57 AM Nico Williams <[email protected]> wrote: > (I'm very down on SCRAM. I'd much rather have an asymmetric zero- > knowledge PAKE.)
Hey, get an OPAQUE-PLUS over the line and I bet someone here will take interest :D (It's hard for me to be more down on SCRAM than I am on plaintext LDAP, though. SCRAM's pretty good.) > I wonder if DANE (DNS-based Authentication of Named Entities [RFC 6698]) > might be a good idea for PG. IMO DANE is a great idea in general, but > browser communities do not agree yet (for reasons, often to do with > performance, which I think by and large do not apply to PG). Possibly. I did briefly look at RPK a few months back, but that was in the context of a pinned key (i.e. "SSH into Postgres") rather than with DANE. I feel like I've seen people talking about DANE a lot more recently? Maybe there'll be momentum for that at some point. --Jacob
