>Users should expect that the web is safe by default In the age of Let’s Encrypt I wouldn’t say that HTTPS implies safety. I can register a phishing site in 5

>Users should expect that the web is safe by default In the age of Let’s Encrypt I wouldn’t say that HTTPS implies safety. I can register a phishing site in 5 minutes with fake credentials, the configure let’s encrypt to get that little padlock icon. No questions asked. HTTPS only guarantees that your traffic is not spied on or modified en route, but for ordinary users that wasn’t an issue in the first place.