diff options
| author | Eric S. Raymond <esr@thyrsus.com> | 2001-02-10 21:24:29 +0000 |
|---|---|---|
| committer | Eric S. Raymond <esr@thyrsus.com> | 2001-02-10 21:24:29 +0000 |
| commit | 4e1db9d3b89d27acf1b80c51c02e73cc7ad69bc1 (patch) | |
| tree | 5845f1d6a2da25f26b472c19abc462570f6888a4 /fetchmail.man | |
| parent | ad89715a43c50c3d50409730318c42ba9dc96d3f (diff) | |
| download | fetchmail-4e1db9d3b89d27acf1b80c51c02e73cc7ad69bc1.tar.gz fetchmail-4e1db9d3b89d27acf1b80c51c02e73cc7ad69bc1.tar.bz2 fetchmail-4e1db9d3b89d27acf1b80c51c02e73cc7ad69bc1.zip | |
Warnings about SSL.
svn path=/trunk/; revision=3040
Diffstat (limited to 'fetchmail.man')
| -rw-r--r-- | fetchmail.man | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/fetchmail.man b/fetchmail.man index 737b92f9..a77926de 100644 --- a/fetchmail.man +++ b/fetchmail.man @@ -770,6 +770,17 @@ is not valid. Some servers may require client side certificates be signed by a recognized Certifying Authority. The format for the key files and the certificate files is that required by the underlying SSL libraries (OpenSSL in the general case). +.PP +Finally, a word of care about the use of SSL: While above mentioned +setup with self-signed server certificates retrieved over the wires +can protect you from a passive eavesdropper it doesn't help against an +active attacker. It's clearly an improvement over sending the +passwords in clear but you should be aware that a man-in-the-middle +attack is trivially possible (in particular with tools such as dsniff, +http://www.monkey.org/~dugsong/dsniff/). Therefore and if possible, +the use of an appropriately ssh tunnel (see below for some examples) +is preferable if you seriously care about the security of your +mailbox. .SH DAEMON MODE The |