I would like to ask a question that I have about MQTT client broker communication. Let's say, a client C1 is connected to the broker with user name and password (with no encryption).
What happens when a new client C2 (a malicious one) tries to publish or subscribe to a topic without actually initiating connection and pretending to be C1? Are there any means by which the server can figure out that C1 is not the one trying to communicate?
This question arises because after the connection process, the broker does not really check for credentials each time it is trying to subscribe or publish to a topic (as far as I am aware - may be wrong altogether).