Stefan Drissen (Exact) asked a question.
"OpenEdge 12.8.11 introduces a breaking security change that permanently removes support for the OECH1 encoding algorithm. This change is required to remediate a known security vulnerability."
With 12.8.11 a strong encoded (ae2h1) password can now be used when connecting to an OpenEdge database. Prior to 12.8.11 only the oech1 encoded passwords could be used.
But what is the point? If you have the encoded password you can connect to the database, so what security does genpassword add over a plain text password? (I never got the point with oech1 either)
If you have the password (encoded or not), you can connect to the database. And in 2026 no one in their right mind is using the same password for multiple ids, protecting a found password from being used elsewhere.
What am I missing?
I understand the desire to remove the insecure OECH1 encoding from the product. And it is surprisingly pervasive. Though I disagree with the packaging: it comes in an update with other bug fixes, after an update that wasn't publicly released. Why not release all the bug fixes as 12.8.11 and then put the breaking changes, together with any requisite code changes, in 12.8.12 and release them together? Then customers could get as up-to-date as possible while they work out whether they need to make any code or configuration changes before applying the breaking changes.
As for the genpassword utility, I always had the same confusion. What is the point? If I can connect to a database with:
mpro db -U robf -P foo
or
mpro db -U robf -P oech1::363d20
Why is the first password considered to be sensitive data but the second is not? For this use case, it doesn't matter that the new encoding is more secure. They should remove the ability to use any encoding prefix with -P.
If you can build a collection of passwords in clear text, it becomes a lot easier to set up dictionary attacks, figure out if passwords are being re-used (even though they shouldn't be) etc.
So hashing your passwords when you store them somewhere is a small step to limit the potential for follow-up attacks in case of a breach.
Well, except if you use the oech1 encoding. That being branded as a vulnerability and getting removed doesn't surprise me at all.
Hashing stored passwords, even badly, is better than nothing.
Unfortunately, OECH1 is an encryption algorithm (with a known cipher and a fixed key), not a hashing algorithm, so it had to go.