owncloud/News-Android-App — pull request #130 by dschuermann (2013-08-24 23:13:25+00:00)
Title: Implement MemorizingTrustManager to prevent MitM attacks

This pull request implements MemorizingTrustManager that replaces the option to disable SSL certificate verification.
Now, when a certificate could not be validated using a CA certificate in Android's CA store, the user can decide to trust a self signed certificate by comparing the fingerprint manually (displayed in a dialog).
If the certificate changes (MitM attack) the dialog comes up again requiring user interaction. This is the main difference to the old "Allow all SSL certs" option.

For certificates with wrong CNs, a option was added to disable hostname verification. This should not be used in most cases!

This changes require the library MemorizingTrustManager with my fixes (as written in the README):
https://github.com/dschuermann/MemorizingTrustManager