On Mon, May 28, 2018 at 12:00:33PM +0300, Heikki Linnakangas wrote: > That's not a new problem, but it makes the MITM protection fairly pointless, > if a fake server can acquire the user's password by simply asking for it. > The client will report a failed connection, but with the user's password, > Mallory won't need to act as a MITM anymore.
Yeah, I know.. Do you think that it would be better to add an extra switch/case at the beginning of pg_fe_sendauth which filters and checks per message types then? -- Michael
signature.asc
Description: PGP signature
