Hacker News Reader

This is silly. SSL is supposed to be a secure conversation between the website and the end user. No one else is between. Encouraging these things is detrimental to internet.

In fact, I would go ahead and say: * Make browser self-signed certs less scarier * Make users more accustomed and knowledgable of self-signed certs.

Browser vendors and corporations need to work together to make the above happen.

View on HN

Consider the discussion taking place in other comments - SSL has never guaranteed a conversation between client and a server at the "end". The concept of one server at the end of your connection is wrong. Often, you'll be connected to a load balancer that terminates SSL and communicates with other servers over plain text. Or, you might reach an HTTP server that communicates with other services ( perhaps a database ) and you have no guarantee that those connections are over SSL or take place on internal networks ( as if internal would make it more secure ). Besides SSL itself and the serving of your particular request, what else is being done with the information you've sent? Perhaps they're storing data or sharing it in ways you would not approve of. Trusting the services you connect to is the real tough problem and it has little to do with SSL.

Reply on news.ycombinator.com