On 28/05/18 12:20, Michael Paquier wrote:
On Mon, May 28, 2018 at 12:00:33PM +0300, Heikki Linnakangas wrote:
That's not a new problem, but it makes the MITM protection fairly pointless,
if a fake server can acquire the user's password by simply asking for it.
The client will report a failed connection, but with the user's password,
Mallory won't need to act as a MITM anymore.
Yeah, I know.. Do you think that it would be better to add an extra
switch/case at the beginning of pg_fe_sendauth which filters and checks
per message types then?
Sounds good.
- Heikki
