This, all the way. Gotta disagree with you here, Ted, and I note you changed your position a bit in the later post: http://www.tedunangst.com/flak/post/in-defen

This, all the way. Gotta disagree with you here, Ted, and I note you changed your position a bit in the later post: http://www.tedunangst.com/flak/post/in-defense-of-opportunistic-encryption http://www.tedunangst.com/flak/post/in-defense-of-opportunis... For what it's worth, I had to use https: to check that from my phone because my provider uses a HTTP transparent proxy (otherwise known as a man-in-the-middle!) - and it's down. (How very unfortunate. Perhaps it should know better than to try and parse my traffic.) And you had a certificate signed by your own CA, and that's no real bother when the link was http: in the first place. I was only able to read your blog because you used OE. Poetic. But I know that every connection I make, GCHQ is a passive MITM on at least one hop. That's more pervasive than a coffee-shop Wifi - and they can inject things into plaintext traffic, too. You think DANE's going to be a problem? I don't think so. It's at least as good as domain-validated certs with a CA - which isn't very good, but it's a reasonable minimum. It helps with pinning.