| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Neil Conway <neilc(at)samurai(dot)com> |
| Cc: | Oliver Elphick <olly(at)lfix(dot)co(dot)uk>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: [Fwd: Bug#184566: security threat to postgresql |
| Date: | 2003-03-21 22:00:03 |
| Message-ID: | 15720.1048284003@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Neil Conway <neilc(at)samurai(dot)com> writes:
> On Fri, 2003-03-21 at 16:06, Oliver Elphick wrote:
>> Is this paranoia, or is it a valid security point. Any comments,
>> please?
> A little from column A, a little from column B, IMHO.
Mostly column A, IMHO. The presumption is that an attacker (a) knows
that program X contains an embedded password and (b) is able to control
the environment in which the program is executed. Given that
combination I can think of hardly anything that would *not* be
vulnerable. For one thing, setting up a man-in-the-middle situation
would be pretty easy.
I can't imagine any situation in which I'd recommend embedding a
password into a postgres client app anyway.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Barry Lind | 2003-03-21 22:00:43 | Re: A bad behavior under autocommit off mode |
| Previous Message | Tom Lane | 2003-03-21 21:36:37 | keys_are_unique optimization causes out-of-buffers failure |