I'm using Ubuntu 12.04 LTS on my developer machine and just realized that psql stores passwords in '~/.pgpass'. Furthermore this file is unencrypted. So anyone who has super user rights (i.e. is in group sudo) can access this file and read stored passwords. That's the worst case it could be.
Instead I'm wondering that psql does not ask for a password (just modified a pg_hba.conf on a postgresql server) and began to doubt about my administration skills.
The documentation just tells us how to create the file and how it should look like.. I want to disable this file as soon as possible. But how?
The problem is pgadmin creates this file when I want to store my passwords. It is a GUI and to use a GUI I'm already logged in and mostly the window manager has something like a keyring that is decrypted when I log in. It would be wonderful if pgadmin could use this but as discussed in the answer: it's a feature request for pgadmin.