Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s6Yp7-000KbA-4W for pgsql-hackers@arkaria.postgresql.org; Mon, 13 May 2024 16:46:50 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1s6Yo8-002KCm-Ub for pgsql-hackers@arkaria.postgresql.org; Mon, 13 May 2024 16:45:48 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s6Yo8-002K6z-JT for pgsql-hackers@lists.postgresql.org; Mon, 13 May 2024 16:45:48 +0000 Received: from mail-oi1-x22b.google.com ([2607:f8b0:4864:20::22b]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1s6Yo0-0001ip-UQ for pgsql-hackers@lists.postgresql.org; Mon, 13 May 2024 16:45:46 +0000 Received: by mail-oi1-x22b.google.com with SMTP id 5614622812f47-3c99e6b8b1fso1390002b6e.1 for ; Mon, 13 May 2024 09:45:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb.com; s=google; t=1715618740; x=1716223540; darn=lists.postgresql.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=7MlYoDDoCEMzVe/bo6rMh+CGl4Tf4eM5cpFXcQUuKKM=; b=KQdVP5VDmp2esSvkNs2aL/Q7a4/kQC8cDlnK6VzUq5CcZ7YM5QNSvaf9s5PTDSXGEx 2H1I3KVJlM7zscVVb0Etd69PTGxtOOEBx6lGW8tLcv/QezXK2lt1lepr6EF4xir+jZRH YaVY6jlqQe/XfuDqWCpK6BMqgKDvcVhXp0Dq1fY36nIAhS8noscQAZ/vp4V/zM1rODHm HcPEY/4xXtT7Aojbx2oiXSqmnYXSKw/8nk/8FVM7kWndtitJtkvEWJuzvfSxN4GHEX2y 9ULTIUmXLW80rLYe9Ux9cN6PO3B2rxONqcvwds0ABoZsNnvqwlSOXC8KkfabNLnRR57L P+rA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715618740; x=1716223540; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=7MlYoDDoCEMzVe/bo6rMh+CGl4Tf4eM5cpFXcQUuKKM=; b=qJPw/TAHVCiFkoI5be8Ji1U2podiv83nglMcfaPP00vGYYCmoc7zGulAcJ+cs0CCTp sCdcprXq7NGiMz1EuVie0nVWFDaeJ5hpogeD1Gv8xrsyhje/Cq9MXZyb+G9sUGOReEiu TwNGaJm2wBFkpRH28zIspb6X9HkKYSr1G1bImTrh5CNFsmUCQJeJhMaixj6KZe+j1oWg cqfGGU9WiD7XH3EbYIbqrdBZjApl0iFOTEuqsVXgkFvjZLqeroFfE83t2qaCuvTRyCIY yFR35hTMOOk1nVD7xg+UQpcJ0KsNA4oiWwM8XVxqIJdq56tuNIj5/LU46EgDqvZqN8rJ v7nw== X-Forwarded-Encrypted: i=1; AJvYcCXqdyWxqMznSV/1S1ArtgGEHl+3240kCxVnDijk+pg+aIy/rHEs/Cc6rxjWVL944vjux7/fUXNgMdLyfPEWlSdHrxJRrhuKThMyAqOTESvg/fNF X-Gm-Message-State: AOJu0YwQYsq0cpS5+g8+aVLUelQmarncItL5vkNafdZ4vNtAnWR0EMre /lR8vxV3tEUJROTAlAWD9jhGb7VKA0ZX78/9d4vdgxsm/tzSKyMmGuaT9TT+o2epLdSZFlvHirs qmInHpyMTyW+Z4qLpm+3Hv96juC0xkDbilqgW X-Google-Smtp-Source: AGHT+IGQKeVvoaZEm2PQCdQn3Z5UaqngNiXRScY8nhbBglu9Qj4jR3cmD/erFpusFe2Nsr2Rbv7dM1TdRlpX1y+VUQQ= X-Received: by 2002:a05:6808:147:b0:3c9:68d4:22a7 with SMTP id 5614622812f47-3c997083771mr13960430b6e.35.1715618738733; Mon, 13 May 2024 09:45:38 -0700 (PDT) MIME-Version: 1.0 References: <5a79ed71-b365-4b20-80bc-9c2bf97bf84b@iki.fi> <3a6f126c-e1aa-4dcc-9252-9868308f6cf0@iki.fi> <1a717f65-7390-4111-8efd-c6e9b213805e@iki.fi> <3fdaf4b1-82d1-45bb-8175-f97ff53a1f01@iki.fi> In-Reply-To: From: Jacob Champion Date: Mon, 13 May 2024 09:45:27 -0700 Message-ID: Subject: Re: Direct SSL connection with ALPN and HBA rules To: Robert Haas Cc: Heikki Linnakangas , Daniel Gustafsson , Michael Paquier , Postgres hackers Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk (There's, uh, a lot to respond to above and I'm trying to figure out how best to type up all of it.) On Mon, May 13, 2024 at 9:13=E2=80=AFAM Robert Haas = wrote: > However, > I disagree with Jacob's assertion that sslmode=3Drequire has no security > benefits over sslmode=3Dprefer. For the record, I didn't say that... You mean Jelte's quote up above?: > sslmode=3Dprefer and sslmode=3Drequire > are the same amount of insecure imho (i.e. extremely insecure). I agree that requiring passive security is tangibly better than allowing fallback to plaintext. I think Jelte's point might be better stated as, =3Dprefer and =3Drequire give the same amount of protection against active attack (none). --Jacob