i am trying to login to my yahoo mail, but no avail. i recently discovered after monitoring some traffic that the dumb yahoo server doesn't send a close_notify response but just acts ignorantly and closes the ssl session. i know if i do this i may be vulnerable to truncation attacks, but i will disable it as soon as i import everything i have from yahoo and then delete my yahoo account. i want to bypass the close_notify verification in firefox (or iceweasel as you want to call it). thanks.
i'll also quote a comment that has been made in the pidgin support board. it's down here:
Both GnuTLS and CDSA (Adium's SSL plugin) check whether a TLS connection has been closed properly by checking if the server sent a
close_notifyalert first. [https://bugzilla.mozilla.org/show_bug.cgi?id=508698 NSS doesn't]. If that alert wasn't sent, GnuTLS and CDSA consider it a fatal error, which for the HTTPS handler means the response is completely discarded. That's what's happening here with Yahoo: their HTTPS server closes the connection without sending
The danger of not checking for that alert is that any MitM may cause a response to be truncated, yet we'd be unable to tell that it is.
Is it really an error condition libpurple should consider fatal? I'm not entirely sure.