2011/10/20 Daniel Stenberg wrote:

> The client MUST verify the server certificate against a CA cert bundle, to
> know that you're in fact talking to the correct server. This verification
> can be skipped, but then it makes the TLS connection insecure. But the
> connection would still be encrypted and not possible to eavesdrop on.

Last part of last sentence above isn't exact.

Without server certificate verification the connection is insecure. <Full stop>

Without server certificate verification the connection is encrypted
and a MITM eavesdropping or modifying encrypted data is perfectly
possible.

-- 
-=[Yang]=-
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html