gregkh/bti — Issue #21: does not validate SSL certificates
Author: evgeni
Created: 2012-01-01 21:51:40+00:00
State: open

Heya,

when using identi.ca¹, bti does not check the SSL certificate, leading to a MITM.

to reproduce:

1. start a httpd with a random cert on port 443
2. put "127.0.0.1 identi.ca api.identi.ca api.twitter.com twitter.com" in /etc/hosts
3. call `echo blah | bti --account a --password b --host identica`

result:

127.0.0.1 - - [01/Jan/2012:22:44:04 +0100] "POST /api/statuses/update.xml HTTP/1.1" 404 1162 "-" "-"
in the access.log of the wrong identi.ca httpd :)

¹: this would apply to twitter too, ofc, here the mitm is limited to the OAuth authentication step though