> A false sense of being secure does seem much worse than knowing that most of the stuff you do is actually insecure to begin with. It may feel so, but it cert

> A false sense of being secure does seem much worse than knowing that most of the stuff you do is actually insecure to begin with. It may feel so, but it certainly isn't. Some security (against anyone but the top 0.X% of "bad guys") is certainly better than no security (random script kiddie in your coffee shop injecting 0-days from exploit-db straight to your browser). And regarding the hopelessness of SSL/TLS - the CA problem exists and is pretty huge. But we know the solution[1]: it's called certificate pinning. When you control clients (Google/Chrom[e/ium]) can just pin your own certs/CA and refuse anything signed by the Hong Kong office. For the rest of us that don't, there's HSTS (to tell the browser to refuse http:// http:// redirects from a MiTM, overriding TLS altogether) and Public Key Pinning Extension (HPKP). They aren't very widely rolled out, but we're getting there. Test your browser here[2], you may be surprised. This all assumes that the user won't ignore the warnings when they come up, of course. Also it would protect you from your second visit onwards - if you're being MiTM'ed at your first attempt to grab a site with all the above bells and whistles, your browser doesn't know about the pinned stuff yet, so it is vulnerable to SSL stripping, etc. In short, it's certainly better than nothing (protecting you from 99%+ of bad guys) and we're slowly fixing it[3]. Don't let the man get you down. [1] Until we get to a proper, more distributed solution [2] https://projects.dm.id.lv/Public-Key-Pins_test https://projects.dm.id.lv/Public-Key-Pins_test [3] Shamefully slowly - TACK was proposed so long ago... https://news.ycombinator.com/item?id=4010711 https://news.ycombinator.com/item?id=4010711