The following is all you need to know about HTTPS "security", or really lack thereof. And it's buried deep in the middle of the text: Weakest link. A crucia

The following is all you need to know about HTTPS "security", or really lack thereof. And it's buried deep in the middle of the text: Weakest link. A crucial technical property of the HTTPS authentication model is that any CA can sign certificates for any domain name. In other words, literally anyone can request a certificate for a Google domain at any CA anywhere in the world, even when Google itself has contracted one particular CA to sign its certificate. It's the elephant in the room that everyone tries to ignore. Google's Chrome browser tries to mitigate the problem, but only for select sites. Firefox has made countless GUI tweaks and other useless changes over the years but has ignored this problem until very recently. Plus, as the article makes clear, everyone and his brother can be a Certificate Authority. The first CA I see when I view certificates in Firefox is: TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı The authorities in Turkey are delighted to have that entity there. But WTF? Why should my security be dependent on their non-malevolence? I sure don't trust them. Not after this: http://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ http://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl...