Security: SkipServerVerification accepts all TLS certificates (QUIC) #1

Severity: Critical

The QUIC client uses SkipServerVerification — a custom ServerCertVerifier that unconditionally accepts all certificates. This disables TLS certificate verification entirely, making QUIC connections vulnerable to MITM attacks on the local network. For a P2P file transfer tool, this means an attacker on the same LAN could intercept, read, or modify transferred files.

Affected Files

• src/protocol/quic.rs (lines 26-87)

Suggested Fix

Since this is a LAN-only tool with ephemeral self-signed certs, proper TOFU (Trust-On-First-Use) would be appropriate:

1. On first connection, pin the server certificate fingerprint and store it
2. On subsequent connections, verify the fingerprint matches the stored one
3. Alert the user if the certificate changes (potential MITM)

At minimum, add a prominent warning in the README and CLI that QUIC mode does not verify server identity.

Issue filed by Hermes — automated code audit