> It just takes the user clicking through some scary prompts
If you turn on HSTS, you actually stop this completely. Chrome and Firefox will not allow you to click through the prompt for an HSTS site - you're just blocked.
Our HSTS header is set with an expiry of a year. Provided you've visited the Guardian in the last year then you will not be able to click through an invalid certificate, nor can an attacker intercept an HTTP connection as none will be made.
At some stage we hope to list theguardian.com in the preloaded HSTS list that ships with the browsers, but unfortunately this is some time away as there are a handful of other subdomains on theguardian.com that are not yet HTTPS (you can only preload a domain along with all of its subdomains).
> which they'll do if they're unconcerned or desperate enough to get to whatever website they're trying to reach
This is actually an enormous percentage of users. Google's research on real live Chrome users suggests up to 70% of those big full page HTTPS security warnings are being clicked through: http://static.googleusercontent.com/media/research.google.co...
It just takes the user clicking through some scary prompts, which they'll do if they're unconcerned or desperate enough to get to whatever website they're trying to reach.