[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACYkhxihUc1V_CXH48FtfdKtk1FsDHOOwTDCL-ZmLodwz9Ly+w@mail.gmail.com>
Date: Wed, 12 Mar 2014 21:36:10 +1100
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE request: claws-mail vcalendar plugin
stores user/password in cleartext
On 12 March 2014 20:56, Marcus Meissner <meissner@...e.de> wrote:
> Note comment by author(?):
> "However, while I agree that CURLOPT_SSL_VERIFYHOST should probably be
> enabled, I do not see any usefulness in enabling CURLOPT_SSL_VERIFYPEER. I
> do not really buy into the extortion racket that certificate authority
> companies run."
>
For people that take this (somewhat valid) stance WRT CAs, the answer is to
retrieve
the self-signed certificate and either add it to the system's ca-trust
store, or specify
CURLOPT_CAINFO with a file containing the self-signed certificate.
Note that CURLOPT_CAINFO doesn't do proper pinning - this won't work with a
CA-issued certificate unless the CA certificate was in the file too, as the
host
certificate would contain the CA:false basicConstraint. That CA could
issue another
certificate for the host and it would be accepted.
Disabling SSL_VERIFYPEER is as obviously broken as an inetd service calling
gets().
An author's claim that this is fine runs counter to users' expectation that
enabling TLS
provides security.
Regards,
Michael
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
