On Thu, 20 Oct 2011, Yang Tse wrote:

> Without server certificate verification the connection is insecure. <Full
> stop>
>
> Without server certificate verification the connection is encrypted and a
> MITM eavesdropping or modifying encrypted data is perfectly possible.

True that. Without certificate verification a MITM attack is not possible to
detect.

But once the connection is established (to a possible MITM attacker), the
connection isn't possible for anyone else to eavesdrop on! =)

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html