Alvaro Herrera <alvherre@dcc.uchile.cl> writes:
> On Wed, Sep 10, 2003 at 07:27:02AM -0400, Andrew Dunstan wrote:
>> If someone can spoof the packet address isn't there also a possibility
>> that they can read your packets and see your random signature?
> Spoofing the packet source address is not quite the same as sniffing a
> connection, which should be encrypted if you do not trust your
> environment AFAIU.
Remember this is a local-loopback connection; the packets will never
leave your own kernel. If the attacker can sniff the packets then he is
already into your kernel, in which case game over. But depending on how
careful your kernel is, it's possible that an attacker who doesn't yet
own your machine could inject forged packets with a local source
address. So I think that indeed there are scenarios where a
random-signature check would be more secure than a source-address check.
The question is whether any of this is worth worrying about in PG.
ISTM the correct solution to such a risk is to tighten your kernel's
packet filtering, not harden one piece of one application.
regards, tom lane
