It's a good idea in theory, but in practice this will be just one more massive JavaScript disaster that's bogging down the connection on both ends for little ac

It's a good idea in theory, but in practice this will be just one more massive JavaScript disaster that's bogging down the connection on both ends for little actual security in return. See, it's the current short-time session that's most likely to be used against you, right there when you're sitting inside a Starbucks and enjoy that latte. Apart from this shortcoming, this scheme will also be difficult to maintain and will probably bring a lot of new exploits into the system that haven't been there before. The solutions here are really simple. Instead of bolting dubious schemes onto HTTP to solve problems that should have been addressed in other layers, let's actually solve it in other layers! Switching to WPA2 is something pretty much any access point could do right away. In the long term, however, I believe we should break the stranglehold browser makers (with the oh-so-open Firefox among the worst) and cert authorities have over HTTPS. (I'd also like to point out, again, how disgusting it is that people are claiming we just discovered this brand new vulnerability, when in fact it has been exploited by mediocre black hats since the dawn of time. Everybody's been knowing this for years, including every single web developer out there.)