3 ms·

OK, so then lets change my equation: unsecure-cert= me + some unknown entity + possibly others no-cert = me + some unknown entity + absolutely others So, and

• agwa 11y ago
  An unencrypted connection isn't "absolutely" seen by others. If no one eavesdrops on it, it's private, just as an encrypted-but-unauthenticated connection is private if no one actively attacks it. Theoretically, an untrusted cert is the lesser evil since active attacks should be harder/more expensive than passive attacks, but no one knows exactly how much harder/more expensive they are in practice. This makes me very hesitant to declare one better than the other. Ultimately, browsers are going to start warning about unencrypted connections, and hopefully one day browsers will treat them just as severely as connections with untrusted certs. Unfortunately, we have to undo decades of bad practices first, which is a slow process.