Interestingly, up to now the only time I've seen an SSL certificate warning was a misconfigured server. This is the first that I've seen an attack throw up a ce

Interestingly, up to now the only time I've seen an SSL certificate warning was a misconfigured server. This is the first that I've seen an attack throw up a cert. error (usually attacks leverage other avenues that don't alarm users). Microsoft research even confirms: "It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives."* * http://msdn.microsoft.com/en-us/magazine/hh288087.aspx http://msdn.microsoft.com/en-us/magazine/hh288087.aspx