But it's not a given that you can "break" SSL. The problem that moxie is highlighting actually has no solution (even HSTS isn't a solution) and relies on users

But it's not a given that you can "break" SSL. The problem that moxie is highlighting actually has no solution (even HSTS isn't a solution) and relies on users to not notice that they have been downgraded to HTTP. Unless moxie also wants to say, with a straight face, that twitter and gmail would be better off disabling HTTPS, I don't think that claim is fair.