And that is somehow worse than letting this 'man' just read the same information any time in Wireshark without ever getting to the middle? Note that with self-

And that is somehow worse than letting this 'man' just read the same information any time in Wireshark without ever getting to the middle? Note that with self-signed certificates the man can only attack in the middle on the very first connection. After that the other end will be known (not authenticated, but known!) and the browser can guard that. Currently, I trust my home DSL connection to not have eavesdroppers everytime when I authenticate to some web service over HTTP. Doing the initial connection once using the same network wouldn't be any worse but it would be much better when using any public wifi when I don't know exactly who is providing the service or who is intercepting the wireless connections.