Hi Maxim, On Fri, 13 Oct 2006 02:48:57 +0300 UTC (10/12/2006, 6:48 PM -0500 UTC my time), Maxim Masiutin wrote:
M> Do you know that The Bat! is the most secure e-mail client. If we will M> allow unsafe actions there and there we will became as insecure as the M> other e-mail clients. What unsafe actions? Accepting an expired SSL cert to a server that already requires CRAM-MD5 authentication? That's up to the user to decide, everyone does it with browsers all the time. LOL... Next thing will be that TB! will not start at all if the user is smoking a cigarette, another unsafe action. In TB!, we don't even have that choice to accept or not, it is taken out of our hands for our benefit and safety... Sounds like a good sales pitch to me :) However, I do not consider Pine (who was designed by Mark C., the "inventor" of the IMAP RFC, Mutt, or Mulberry, or several others insecure by any means..... The IMAPS server already requires CRAM-MD5 over SSL v3 auth. Yet, they let me choose to permanently accept any cert... M> Why don't you simply use "regular" connection instead of TLS with expired M> certificate? Can't, the remote server is configured only for IMAP with SSL only (port 993), not 143 standard which is not even opened in the firewall. Wouldn't it be easier to just let the customer decide. This has nothing to do with unsafe actions, just some fine tuning of programming the Address book / trusted root CA to not block expired certs. We are not talking about a root cert for e-commerce doing credit card transactions here.. -- Gary ________________________________________________________ Current ALPHA is 3.86.03 | 'Using TBBETA' information: http://www.silverstones.com/thebat/TBUDLInfo.html IMPORTANT: To register as a Beta tester, use this link first - http://www.ritlabs.com/en/partners/testers/
