bugtraq - Re: iphone email client does not validate ssl certificates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 28 Sep 2009 21:27:34 -0400
From: Steve Shockley <steve.shockley@...ckley.net>
To: bugtraq@...urityfocus.com
Subject: Re: iphone email client does not validate ssl certificates

On 9/26/2009 5:54 AM, Pavel Machek wrote:
> Well... mujmail.org email client also does not validate ssl
> cerificates -- optionaly. Reasoning is that SSL with unverified
> certificate is still better than sending plaintext passwords.
>
> Does that count as a vulnerability?

Yes; it's not that difficult for someone on the same network segment to 
proxy all your traffic, and if you don't check your certificate then you 
might as well have sent it plaintext.

If you don't want to buy a cert, then set up your own mini-CA and 
install the CA root cert on your client.