Re: SCRAM with channel binding downgrade attack

Поиск
Список
Период
Сортировка
От Peter Eisentraut
Тема Re: SCRAM with channel binding downgrade attack
Дата
Msg-id ccc205da-15ec-0fb2-54dd-a57592bf364b@2ndquadrant.com
обсуждение исходный текст
Ответ на Re: SCRAM with channel binding downgrade attack  (Michael Paquier <michael@paquier.xyz>)
Ответы Re: SCRAM with channel binding downgrade attack  (Magnus Hagander <magnus@hagander.net>)
Список pgsql-hackers
On 6/6/18 18:04, Michael Paquier wrote:
> On Wed, Jun 06, 2018 at 11:53:06PM +0300, Heikki Linnakangas wrote:
>> That would certainly be good. We've always had that problem, even with md5
>> -> plaintext password downgrade, and it would be nice to fix it. It's quite
>> late in the release cycle already, do you think we should address that now?
>> I could go either way..
> 
> I would be inclined to treat that as new development as this is no new
> problem.

I agree.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Peter Eisentraut
Дата:
Сообщение: Re: Supporting tls-server-end-point as SCRAM channel binding forOpenSSL 1.0.0 and 1.0.1
Следующее
От: Magnus Hagander
Дата:
Сообщение: Re: SCRAM with channel binding downgrade attack