[Pidgin] #7002: Certificates should be subject to examination WITHOUT acceptance

[Pidgin]

#7002: Certificates should be subject to examination WITHOUT acceptance
--------------------------+-------------------------------------------------
 Reporter:  baby          |     Owner:  lschiere
     Type:  defect        |    Status:  new     
Component:  unclassified  |   Version:  2.5.0   
 Keywords:                |  
--------------------------+-------------------------------------------------
 Hi,

 today I couldn't connect to msn 'cause I got an invalid certificate for
 login.live.com.

 According to [wiki:"Using
 Pidgin#Igetacceptrejectcertificatepromptsallthetime.WhatdoIdo" the FAQ],
 I'm suppose to ''accept'' a possible bogus certificate in order to export
 it and send it to you for analysis and possible inclusion?

 If this were an attempt to hijack my msn account, this would gladly
 succeed, since I'd be '''accepting a fake certificate''' and then sending
 them my username/password encrypted for the hijacker to decrypt with his
 own private key...

 The only info pidgin would give me without accepting the certificate is
 its SHA1 fingerprint.

 The offending cert is for login.live.com and the SHA1 fingerprint is
 18:16:d2:5e:af:db:85:23:ba:71:66:2f:2d:03:be:8f:91:bc:44:4e.
 [[BR]]Activation date: Wed Jun 18 21:00:00 2008[[BR]]
 Expiration date: Mon Jul 20 20:59:59 2009[[BR]]
 (don't even know if times are local or UTC... I'm at UTC-0300).

 I'd rather not use pidgin with MSN a few days than risking exposing all my
 account info and passwords to a possible hijacker.

 But I think that the way pidgin is treating unverified certificates poses
 a social security problem ([wiki:"Using Pidgin" the Official Pidgin FAQ]
 is telling people to trust untrustable certs).

 FWIW, I'm using the ubuntu pidgin and pidgin-data packages version
 2.5.0-0ubuntu2~hard1 from the hardy-backports official repositories.

-- 
Ticket URL: <http://developer.pidgin.im/ticket/7002>
Pidgin <http://pidgin.im>
Pidgin