HTTPS is a good enough baseline if all you care about is doing business. If you're an individual trying to protect yourself online, it's not a good baseline. S

HTTPS is a good enough baseline if all you care about is doing business. If you're an individual trying to protect yourself online, it's not a good baseline. SSH is a good example of this. You can totally MITM brand new SSH connections all day, because nobody ever checks the fingerprint (and virtually all server-side automation just ignores them completely). The only attacker we actually care about with SSH is a really stupid one who thinks that trying to MITM every session at random will actually succeed. (It won't.) If the attacker is smart, they'll use targeted attacks in ways that they are more likely to find a first-try connection, and MITM that. So, why do we use SSH? Because it mostly defeats the dumbest possible attacks. With HTTPS, instead of the attacker targeting a user, the attacker [in the future] targets cert creation. If they succeed, they get full MITM; if they fail, they lose nothing. And they get to keep trying, on every single damn CA, and on any target site they choose. So, why do we even use HTTPS? Because it solidly defeats the dumbest possible attacks. Neither of these are good baselines, but with HTTPS it's even worse, because the user has no way of defending themselves. At least with SSH I can enforce my own known_hosts file. With HTTPS, I am at the mercy of the electronic gods that maintain my browser and generate certs. And (importantly, I think) if someone compromises my SSH connection, at worst they get to control my server. Oh noooo! There goes my private git repo! Whereas if they MITM my HTTPS connection, they get my retirement fund. HTTPS is like a wall that surrounds the village, built by the tribal leaders. We can't touch it, except to climb the rungs of ladders built into the wall. It will keep out the wolves, but not enemy soldiers. For now, it's good enough at keeping the wolves at bay, so we still use it. But one day soon the wolves will learn to climb ladders. https://www.youtube.com/watch?v=G_cTl4wR81Q https://www.youtube.com/watch?v=G_cTl4wR81Q