Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cyLLu-0006TV-Fo for pgsql-hackers@arkaria.postgresql.org; Wed, 12 Apr 2017 16:42:42 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1cyLLu-00084C-1Q for pgsql-hackers@arkaria.postgresql.org; Wed, 12 Apr 2017 16:42:42 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1cyLLs-00082D-B1 for pgsql-hackers@postgresql.org; Wed, 12 Apr 2017 16:42:40 +0000 Received: from tamriel.snowman.net ([72.66.115.51]) by makus.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cyLLn-0000m5-A9 for pgsql-hackers@postgresql.org; Wed, 12 Apr 2017 16:42:36 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id B2B3C5F794; Wed, 12 Apr 2017 12:42:04 -0400 (EDT) Date: Wed, 12 Apr 2017 12:42:04 -0400 From: Stephen Frost To: Tom Lane Cc: Heikki Linnakangas , Bruce Momjian , Magnus Hagander , =?iso-8859-1?Q?=C1lvaro_Hern=E1ndez?= Tortosa , Andres Freund , pgsql-hackers Subject: Re: Some thoughts about SCRAM implementation Message-ID: <20170412164204.GC9812@tamriel.snowman.net> References: <20170410183230.oxagjpfgj6xxmcwx@alap3.anarazel.de> <20170412004118.GC20340@momjian.us> <20170412005830.GU9812@tamriel.snowman.net> <20170412012532.GF20340@momjian.us> <20170412152629.GI20340@momjian.us> <20a91441-fa4c-ec2c-d813-c549066b8055@iki.fi> <8328.1492013344@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="AD4A8kmLreM1pNBx" Content-Disposition: inline In-Reply-To: <8328.1492013344@sss.pgh.pa.us> X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-91-generic (x86_64) X-Uptime: 12:40:58 up 277 days, 18:05, 32 users, load average: 0.10, 0.12, 0.14 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org --AD4A8kmLreM1pNBx Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Tom, all, * Tom Lane (tgl@sss.pgh.pa.us) wrote: > ... which the user can't tell apart from having fat-fingered the password, > I suppose? Doesn't sound terribly friendly. A report of a certificate > mismatch is far more likely to lead people to realize there's a MITM. We might be able to improve on that. > So this seems more like a hack than like a feature we need so desperately > as to push it into v10 post-freeze. Channel binding certainly isn't a 'hack' and is something we should support, but I agree that it doesn't need to go into v10. Thanks! Stephen --AD4A8kmLreM1pNBx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJY7ljcAAoJEO1sijiDR2RVWf4P/Rp3jcLdAyB6xl8MGyPsFPAp 4q9lI8bVacvpzEq0s+7CVeID+VTHHg6dK2liOZvVK2ONESSkW04Bt1V/FCDlBNar aaWEYOeA3CTB3KiAUk0IgooOlvBUTsQ4fHxnbNCIV5AOuAQp7dF+rYNXQnZ48Zyy CXrlkzsZF3McyLBEk8dIVDSxI9FSG7mBvbX91gZJbc5NXjhBl4V4gvo5Dk/aElDA 61W9ouDui9+LIIIA7IPslUpFJVTP4IRdZskvoE5UJ4kWxBJklW1vcTN5BclvdTZM BRSgSolO5MOZ2pIxd//xnV1J6mnYDrI251FjiWgY2LSbHNohXz/fnMfOo6OqbECh aL0l8CIdH1z+7LQzO5SRGuJOq4YeqbhREz1t+Tm203ENSfXIYSVYYCAZWwQnr1C0 jLwiqLo0RxQkAjwIsMY2fWLvS0aZgq1xpAc3OP3DkOrE7xaSKZzOhj3dtQD/XHjf 9m3YL3nYH85GeZ+Y7v0tooNW7ma6PDlgmzjLEw9KVE6tbrtcTSLmdDHJhbkIFI2t jETGkY5CFM+r/uI626dq8IzJr+gpt19jlW69uJCiAdBz7ywqkctvZcAVexdtzqJN EhLQwJv9qX/BGJjabrnnBcRyyrwATArqgTahlZxIhdSS1Dzg0dI55DVy1lVLKZH9 xlLA4+MeqyAIxo0P168b =3GBK -----END PGP SIGNATURE----- --AD4A8kmLreM1pNBx--