{"action":"created","issue":{"url":"https://api.github.com/repos/redsolution/xabber-android/issues/371","labels_url":"https://api.github.com/repos/redsolution/xabber-android/issues/371/labels{/name}","comments_url":"https://api.github.com/repos/redsolution/xabber-android/issues/371/comments","events_url":"https://api.github.com/repos/redsolution/xabber-android/issues/371/events","html_url":"https://github.com/redsolution/xabber-android/issues/371","id":58966909,"number":371,"title":"Xabber silently accepts invalid certificates","user":{"login":"BrianBlade","id":7414587,"avatar_url":"https://avatars.githubusercontent.com/u/7414587?v=3","gravatar_id":"","url":"https://api.github.com/users/BrianBlade","html_url":"https://github.com/BrianBlade","followers_url":"https://api.github.com/users/BrianBlade/followers","following_url":"https://api.github.com/users/BrianBlade/following{/other_user}","gists_url":"https://api.github.com/users/BrianBlade/gists{/gist_id}","starred_url":"https://api.github.com/users/BrianBlade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BrianBlade/subscriptions","organizations_url":"https://api.github.com/users/BrianBlade/orgs","repos_url":"https://api.github.com/users/BrianBlade/repos","events_url":"https://api.github.com/users/BrianBlade/events{/privacy}","received_events_url":"https://api.github.com/users/BrianBlade/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-25T20:48:35Z","updated_at":"2015-02-25T20:53:40Z","closed_at":null,"body":"Xabber accepts certificates for different domains (i.e., CommonName doesnt match hostname) and from untrusted CAs. Tested with 0.10.23a (on CM11) and 0.9.30f (on CM7) from F-droid. So basically there is no certificate verification at all. \r\nI believe Xabber used to perform some kind of TOU with public key pinning when I last used it but thats not enabled anymore?"},"comment":{"url":"https://api.github.com/repos/redsolution/xabber-android/issues/comments/76054328","html_url":"https://github.com/redsolution/xabber-android/issues/371#issuecomment-76054328","issue_url":"https://api.github.com/repos/redsolution/xabber-android/issues/371","id":76054328,"user":{"login":"BrianBlade","id":7414587,"avatar_url":"https://avatars.githubusercontent.com/u/7414587?v=3","gravatar_id":"","url":"https://api.github.com/users/BrianBlade","html_url":"https://github.com/BrianBlade","followers_url":"https://api.github.com/users/BrianBlade/followers","following_url":"https://api.github.com/users/BrianBlade/following{/other_user}","gists_url":"https://api.github.com/users/BrianBlade/gists{/gist_id}","starred_url":"https://api.github.com/users/BrianBlade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BrianBlade/subscriptions","organizations_url":"https://api.github.com/users/BrianBlade/orgs","repos_url":"https://api.github.com/users/BrianBlade/repos","events_url":"https://api.github.com/users/BrianBlade/events{/privacy}","received_events_url":"https://api.github.com/users/BrianBlade/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T20:53:40Z","updated_at":"2015-02-25T20:53:40Z","body":"Further testing revealed that the certificate warning pops up with several minutes delay - after I already sent and received some messages."}}