From: | Greg Stark <greg(dot)stark(at)enterprisedb(dot)com> |
---|---|
To: | Peter Eisentraut <peter_e(at)gmx(dot)net> |
Cc: | Magnus Hagander <magnus(at)hagander(dot)net>, Robert Haas <robertmhaas(at)gmail(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, PG Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: SSL cleanups/hostname verification |
Date: | 2008-10-21 08:22:33 |
Message-ID: | 731550C3-C781-4F81-B790-39861A158762@enterprisedb.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Then they may as well not have bothered with generating a key in the
first place since an attacker can generate one of his own just as
easily...
Actually that's not entirely true. A non-authenticated connection
still protects against passive attacks like sniffers. But active
attacks are known in the wild.
greg
On 21 Oct 2008, at 09:04 AM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> Magnus Hagander wrote:
>> Robert Haas wrote:
>>>>> How can you make that the default? Won't it immediately break
>>>>> every
>>>>> installation without certificates?
>>>> *all* SSL installations have certificate on the server side. You
>>>> cannot
>>>> run without it.
>>> s/without certificates/with self-signed certificates/
>>>
>>> which I would guess to be a common configuration
>> Self-signed still work. In a self-signed scenario, the server
>> certificate *is* the CA certificate.
>
> But the user needs to copy the CA to the client, which most people
> probably don't do nowadays.
>
> --
> Sent via pgsql-hackers mailing list (pgsql-hackers(at)postgresql(dot)org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-hackers
From | Date | Subject | |
---|---|---|---|
Next Message | Martijn van Oosterhout | 2008-10-21 09:01:28 | Re: SSL cleanups/hostname verification |
Previous Message | Matthieu Imbert | 2008-10-21 08:21:38 | binary representation of datatypes |