Re: Specifying server name in certificate for TLS connection

[Filipe Silva]

Well, connection strings are often hard-coded in configuration files, sometimes obfuscated by layers of components in the application stack. A not-so-well informed user may deploy such applications not even being aware they exist. An attacker that somehow gains access to the applications setup may tamper with them and cause unexpected harm or maybe even be able open back doors or so.

Of course we all need to live with connection strings and it's up to the developers to protect their systems configurations the best they can. Of course we can argue that if one has access to an application connection string then probably almost everything else is also open to them... anyway, I think we all benefit from a smaller attacking surface and the question is how we weight the pros and cons here.