> > 
> > bzero'ing a hash buffer is not a complete solution to the problem,
> > since the process may contain other potentially sensitive data
> > in its address space.  What you really want to do is protect
> > the cores.
> > 

I consider it as a bad move too and performance degradation.
Why only DB? Why you don't automatically clear stack too? :-)

Passwords can be stored anywhere in the application,
and it is per-application task to clear sensetive data anywhere.

Please, back out this change.

> And what about a user attaching a debugger to a running ftpd...

He must be root for that.

-- 
Andrey A. Chernov
<ache@nagual.ru>
http://www.nagual.ru/~ache/