Re:MySQL Local/Remote Account Password Cracking
by robbles on Wednesday December 05, 2012 @12:30AM
(#4875042)
It's sometimes used to clear the connection state with persistent connections to the database (say for example in a high-traffic web app). Changing to the same user clears any state and local settings from the previous use of the connection and cancels the current transaction (I believe).
[ Parent
| on HN ]
Re:MySQL Local/Remote Account Password Cracking
by Bakkot on Wednesday December 05, 2012 @01:35AM
(#4875213)
Easy enough to make it return instantly when switching to the current user. This would still allow for someone to crack their own password (a problem if someone has access to the database without having the password, say by an SQL injection), but would mitigate most of the problem without breaking things for almost anyone.