As much as I hate to say it, if it would be insecure when not using ssl, this is a feature that people would definitely use insecurely and one day it would be labeled as a 'security hole' in postgresql.
Chris ----- Original Message ----- From: "Bill Moran" <[EMAIL PROTECTED]> To: "Bruce Momjian" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Tuesday, June 15, 2004 8:13 AM Subject: Re: [GENERAL] Feature idea > Bruce Momjian <[EMAIL PROTECTED]> wrote: > > > Chris Ochs wrote: > > > > > > What if SET SESSION AUTHORIZATION could also accept a password so that non > > > superusers could switch to a different user? How difficult would this be? > > > > Well, the password would go over the wire unencrypted, causing a > > security problem. > > Only if encrypted transport is not enabled. With encrypted transport, it would > be as secure as anything else, right? > > Perhaps, it could only be available if transmission encryption is enabled? Then > again, there's a certain amount of "only the user can shoot his own foot" that > has to be accepted ... > > Just thinking out loud ... > > -- > Bill Moran > Potential Technologies > http://www.potentialtech.com > ---------------------------(end of broadcast)--------------------------- TIP 4: Don't 'kill -9' the postmaster
