On 2017-04-10 20:28:27 +0200, Álvaro Hernández Tortosa wrote: > > > On 10/04/17 13:02, Heikki Linnakangas wrote: > > On 04/10/2017 12:39 PM, Álvaro Hernández Tortosa wrote: > > > - I think channel binding support should be added. SCRAM brings security > > > improvements over md5 and other simpler digest algorithms. But where it > > > really shines is together with channel binding. This is the only method > > > to prevent MITM attacks. Implementing it should not very difficult. > > > There are several possible channel binding mechanisms, but the mandatory > > > and probably more typical one is 'tls-unique' which basically means > > > getting the byte array from the TLSfinish() message and comparing it > > > with the same data sent by the client. That's more or less all it takes > > > to implement it. So I would go for it. > > > > We missed the boat for PostgreSQL 10. You're right that it probably > > wouldn't be difficult to implement, but until there's a concrete patch > > to discuss, that's a moot point. > > Really? That's a real shame.... I know we're very late in the CF cycle > but, again, this would be a real shame.
That can equally be said about about a lot of features. If we don't stop at some point... Also, we're not late in the CF cycle, the CF cycle for v10 is over. It's not like the non-existance of channel binding removes previously existing features, or makes SCRAM useless. Greetings, Andres Freund -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers