3

I am trying to search on XMPP. I got the code from here. It works fine and I am able to connect to the server. But its showing the alert window like this

Warning for connection

and If I click "Always" or "Once" it is accepting and I am able to show the contacts and chat messages....

Is there any way to stop this alert and can I connect directly to the server?

4
  • If you compile the app by yourself, you can add one of the many tricks which aim at suppressing this warning. Warning: Most solutions here on StackOverflow will completely eliminate all security which SSL offers. Regardless of whether you want to maintain some security or not, the trick is to install a customised certificate manager. Dec 12, 2013 at 13:04
  • 1
    @ClassStacker can i get the customised certificate readily. or should I implement/modify it in the code.
    – sarabu
    Dec 12, 2013 at 13:14
  • It's a customised certificate manager. Yes there are working code snippets to be found here on StackOverflow. As I said, most of them will break the SSL security completely. You need to be aware of your requirements to choose the best solution for your needs. Dec 12, 2013 at 15:03
  • 1
    If you are not interested in security, as your bounty comment implies, you should not be writing/changing a chat application. Your users deserve better than ignorance, and people who are relying on chat apps for secure communication might get hurt due to this.
    – ge0rg
    Jan 2, 2014 at 15:38

3 Answers 3

10

This message is displayed by MemorizingTrustManager (MTM), an Android library aimed to improve the security/usability trade-off for "private cloud" SSL installations.

MTM issues this warning whenever you connect to a server with a certificate not issued by one of the Android OS trusted Root CAs, like a self-signed certificate or one by CACert.

If the message appears again after you clicked "Always", this is a bug in MTM (probably due to a mismatching SSL server name), and should be reported via github.

Edit: if you are making an app that only communicates with one server, and you know the server's certificate in advance, you should replace MTM with AndroidPinning, which ensures that nobody can make man-in-the-middle attacks on your connection.

Disclaimer: I am the author of MTM and the mainainer of yaxim.

3

Get the certificate signed by a certificate authority. Forget all coding solutions.

6
  • "Get the certificate signed by a certificate authority" - that's not really helpful since a CA does not warranty anything useful. In essence, you pay someone for a product that has no warranty and carries no liability. Save your money and use a self signed certificate. Self signed certificates offer equivalent security. The real problem here is the Security UI. Confer, plain text HTTP - good; HTTPS with self signed (opportunistic encryption) - bad; HTTPS from a CA with no warranty - good. When did plain text become better than opportunistic encryption?
    – jww
    Jan 7, 2014 at 22:48
  • @noloader Rubbish. Self-signed certificates are not equivalent to CA-signed certificates. For one thing they motivate thousands of question like this, which in turn end up with all kinds of dubious and insecure 'solutions'. The CA signature says that the identity expressed in the certificate is owned by the person the certificate was issued to, and that it has been checked via some offline process. You don't seem to know the first thing about it. If you want to vent your spleen about the CA industry, this answer is not the place to do it. Your final two sentences are merely illogical.
    – user207421
    Jan 7, 2014 at 22:57
  • "For one thing they motivate thousands of question like this" - that's the broken UI's, not self signed certificates.
    – jww
    Jan 7, 2014 at 23:02
  • "The CA signature says that the identity expressed in the certificate is owned by the person the certificate was issued to..." - you need to read those CA CPS's and see what the CAs are actually claiming. I can tell you for certain its nothing useful because I read them (just for fun to see what they don't warrant and what they disclaim).
    – jww
    Jan 7, 2014 at 23:04
  • "Your final two sentences are merely illogical..." - that's a fact of real life, and there's no opinion to it. Try any browser and point me to different results.
    – jww
    Jan 7, 2014 at 23:06
2

Is there any way to stop this alert and can I connect directly to the server?

Its not clear to me if you wrote this app that connects to kluebook.com. I think you did, but its not explicit.

Assuming you wrote the app and know the server you are connecting to (kluebook.com), you should provide a custom TrustManager to handle this. You can find code for a custom TrustManger that works with the expected server certificate in OWASP's Certificate and Public Key Pinning example. Its OK to pin because you know what the certificate or public key is, and there's no need to trust someone else like a CA.

If you have no a priori knowledge, then you trust on first use and follow with a key continuity strategy looking for abrupt changes in the certificate or public key. In this case, the trust on first use should include the customary X509 checks.

Pinning is part of an overall security diversification strategy. A great book on the subject is Peter Gutmann's Engineering Security.

What you are seeing with the prompt is one leg of the strategy - namely, the Trust-On-First-Use (TOFU) strategy. The prompt has marginal value because user's don't know how to respond to it, so they just click yes to dismiss the box so they can continue what they are doing. Peter Gutmann has a great write-up on user psychology (complete with Security UI studies) in Engineering Security.

From section 6.1 of OWASP's Certificate and Public Key Pinning:

public final class PubKeyManager implements X509TrustManager
{
  private static String PUB_KEY = "30820122300d06092a864886f70d0101...";

  public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException
  {
    if (chain == null) {
      throw new IllegalArgumentException("checkServerTrusted: X509Certificate array is null");
    }

    if (!(chain.length > 0)) {
      throw new IllegalArgumentException("checkServerTrusted: X509Certificate is empty");
    }

    if (!(null != authType && authType.equalsIgnoreCase("RSA"))) {
      throw new CertificateException("checkServerTrusted: AuthType is not RSA");
    }

    // Perform customary SSL/TLS checks
    try {
      TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
      tmf.init((KeyStore) null);

      for (TrustManager trustManager : tmf.getTrustManagers()) {
        ((X509TrustManager) trustManager).checkServerTrusted(chain, authType);
      }
    } catch (Exception e) {
      throw new CertificateException(e);
    }

    // Hack ahead: BigInteger and toString(). We know a DER encoded Public Key begins
    // with 0x30 (ASN.1 SEQUENCE and CONSTRUCTED), so there is no leading 0x00 to drop.
    RSAPublicKey pubkey = (RSAPublicKey) chain[0].getPublicKey();
    String encoded = new BigInteger(1 /* positive */, pubkey.getEncoded()).toString(16);

    // Pin it!
    final boolean expected = PUB_KEY.equalsIgnoreCase(encoded);
    if (!expected) {
      throw new CertificateException("checkServerTrusted: Expected public key: "
                + PUB_KEY + ", got public key:" + encoded);
      }
    }
  }
}

You can get the expected public key from OpenSSL's s_client, but you have to know the port. I can't get a response from the well known SSL ports like 5223, and 5222 has no security services:

$ openssl s_client -connect kluebook.com:5222
CONNECTED(00000003)
140735088755164:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:766:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 322 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Once you get a public key, plug it back into the TrustManager at PUB_KEY.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.