Re: CVE request: xchat/hexchat don't properly verify SSL certificates

[Michael Samuel <mik () miknet net>]

On 30 January 2015 at 06:24, Sam Dodrill <shadow.h511 () gmail com> wrote:
> A lot of the time IRC networks will not pay for a verified SSL cert due to
> the fact that the kind of SSL cert they would need (a wildcard one) is
> financially prohibitive. I don't think this is a security bug with hexchat
> more a symptom of the fact that SSL combines encryption and identity
> verification where sometimes people only want the former.

The correct response to this is for them to publish their self-signed
certificate (or even a CA certificate) and have it pasted into the
client, along with the configuration.

The client could then perform a byte-wise compare of the public key.

I assume well-known networks could have their certificates hard-coded
into the client.