Honestly, browsers are not the worst offenders here or the worst mistake. MUAs are. There's no MUA-STS, the user interaction required to accept an insecure con

Honestly, browsers are not the worst offenders here or the worst mistake. MUAs are. There's no MUA-STS, the user interaction required to accept an insecure connection is often too trivial, the authentication methods allow easy credential theft and prolonged reuse.