News for hackers. Stuff that matters.
Re:Launching in 2015: A Certificate Authority to Encrypt the... by SilasX on Tuesday November 18, 2014 @01:45PM (#8625494)
>So when you accept the connection unencrypted, you tell the user agent "hey - everything is ok here - I don't care about this conversation to be private", so no error message is shown.

Maybe a security-conscious person thinks that, but the typical user does not knowingly choose http over https, and thus the danger of MitM and (unaccepted) snooping is at least as large for the former.

So it's somewhat debatable why we'd warn users that "hey, someone might be reading this and impersonating the site" for self-signed https but not http.

There are no comments on this comment yet.