I have a Linux box that is on Comcast cable.

I also have a Android Cell phone that is on a phone company's IP
network.

The home Linux server runs dovecot IMAP server, uses SSL and does NOT
have any officially signed site certificate.

It works fine with most IMAP clients, but Android phone requires a
valid certificate. It will, however, work with an unsecured
connection, which I have not yet enabled for security reasons.

So, my question is, how practically risky is it to enable plain text
log in from my cell phone?

Inside the home, I use network switches only (not hubs) and I am the
root level administrator.

i
Look up how to create a self-signed certificate. If you trust yourself

i
Look up how to create a self-signed certificate. If you trust yourself
that is just as secure as trusting a CA

Ignoramus17493 wrote:
I have a Linux box that is on Comcast cable.

I also have a Android Cell phone that is on a phone company's IP
network.

The home Linux server runs dovecot IMAP server, uses SSL and does NOT
have any officially signed site certificate.

Can you install root certificates? Then look into CACert

It works fine with most IMAP clients, but Android phone requires a
valid certificate. It will, however, work with an unsecured
connection, which I have not yet enabled for security reasons.

So, my question is, how practically risky is it to enable plain text
log in from my cell phone?

Inside the home, I use network switches only (not hubs) and I am the
root level administrator.

i
Look up how to create a self-signed certificate. If you trust yourself
that is just as secure as trusting a CA

If I understand the OP correctly, Android doesn't like those.

Ignoramus17493 wrote:
I have a Linux box that is on Comcast cable.

I also have a Android Cell phone that is on a phone company's IP
network.

The home Linux server runs dovecot IMAP server, uses SSL and does NOT
have any officially signed site certificate.

It works fine with most IMAP clients, but Android phone requires a
valid certificate. It will, however, work with an unsecured
connection, which I have not yet enabled for security reasons.

So, my question is, how practically risky is it to enable plain text
log in from my cell phone?

Inside the home, I use network switches only (not hubs) and I am the
root level administrator.

i
Look up how to create a self-signed certificate. If you trust yourself
that is just as secure as trusting a CA

On 2009-05-27, Mike Rechtman <m... at (no spam) rechtman.com> wrote:



Ignoramus17493 wrote:
I have a Linux box that is on Comcast cable.

I also have a Android Cell phone that is on a phone company's IP
network.

The home Linux server runs dovecot IMAP server, uses SSL and does NOT
have any officially signed site certificate.

It works fine with most IMAP clients, but Android phone requires a
valid certificate. It will, however, work with an unsecured
connection, which I have not yet enabled for security reasons.

So, my question is, how practically risky is it to enable plain text
log in from my cell phone?

Inside the home, I use network switches only (not hubs) and I am the
root level administrator.

i
Look up how to create a self-signed certificate. If you trust yourself
that is just as secure as trusting a CA

The phone does not accept such certificates. This is the problem.

i

The phone does not accept such certificates. This is the problem.

According to a comment on http://code.google.com/p/android/issues/detail?id=1077
it does after a config change (although the poster seems to think that
will allow MITM attacks!!!!)

Failing that, just go buy a signed cert - a quick surf shows them
available from around £8 GBP/annum (approx 10 USD). But the CN on the
cert will still need to match the DNS entry you use to connect.

Overall, though the security would be similar to that of making a voice
call from a landline.

David Woolley <david at (no spam) ex.djwhome.demon.co.uk.invalid> writes:
[imap without ssl]
Overall, though the security would be similar to that of making a voice
call from a landline.

Except that you don't normally read your unix password over the telephone for
the benefit of eavesdroppers.

Plus the fact that I don't think you're right, in general, because I
understand that some cable modems see some other houses' data, depending

on the network topology. You can't normally get other houses' data with
land-line telephone service. (Assuming it's not a "party line", you're
not using any "cordless" telephone units, etc.)

Alan J Rosenthal wrote:
David Woolley <david at (no spam) ex.djwhome.demon.co.uk.invalid> writes:
[imap without ssl]
Overall, though the security would be similar to that of making a voice
call from a landline.

Except that you don't normally read your unix password over the telephone
for the benefit of eavesdroppers.

On the other hand, people feel more comfortable giving credit card
details over it than they do with broadband.

Plus the fact that I don't think you're right, in general, because I
understand that some cable modems see some other houses' data, depending

That's possible. I'm in the UK and most people are on routed ADSL,
which doesn't have that problem.

You say that, but when I first got my ADSL installed, I was receiving not

You say that, but when I first got my ADSL installed, I was receiving not
only my traffic but copies of packets for someone in the next town
....

Oh... and... I can't let someone's mention of credit card numbers go by
without commenting. Credit card numbers aren't passwords.