
Advanced SQL Server Man-In-the-Middle Attacks - el_duderino
http://blog.blindspotsecurity.com/2017/12/advanced-sql-server-mitm-attacks.html
======
fowl2
I must be jaded, but isn't this obvious? If you don't validate certs you're
vulnerable to MITM. If you don't mandate encrpytion on your client, you're
vulnerable to downgrade attacks.

It would be nice if the common driver libraries supported key pinning in the
connection string.

