[xg15]

With all due respect, how is that worse than HTTP? Plain HTTP can be MITMed just as well, only that on HTTP - except that no one would do that because for HTTP, plain old packet sniffing is enough to eavesdrop on a connection. Which doesn't work for self-signed HTTPS connections. And there are in fact a lot of common scenarios where it is easy for an attacker to sniff packets but harder to establish an MITM.

[Zikes]

Because you'd never put your credit card into an HTTP web site, but you would on HTTPS.

Your argument about MITM being uncommon is moot because it's not impossible and is only rare because the current system is the way that it is. Changing the system would change the attackers' methods.

[icebraining]

Worse in the sense that you expect an HTTPS connection to be secure, while you don't (or shouldn't!) expect an HTTP connection to be.

[Karunamon]

Then treat a self signed HTTPS cert as equivalent to an unsecured HTTP connection and be done with it.

There's absolutely no reason that the most common failure modes (expiration, bare domain vs www., self signed) presents warnings that Something Fishy Is Going On®, when 9999/10000 times, there is not.

Smoke coming from my neighbor's yard in the summer might be a fire, but in all likelihood, they're running a barbecue grill. The SSL equivalent would be calling the fire department every time someone puts some steaks on.

[icebraining]

You can't treat a self-signed HTTPS cert as equivalent, because it has "https" in the URL, which people use to distinguish a safe connection from an unsafe one.

[Karunamon]

In a graphical browser as used by most people? Sure you can. Chrome's method of striking out the https bit and turning it red is quite evocative.

What I take issue with here is the "HOLY CRAP, STOP EVERYTHING!" nature of the warnings as thrown by browsers nowadays. The severity of the warning is not proportional to the likelihood of there being something actually wrong, hence crying wolf. ("Yes, I know this is a self signed cert, because it's mine, now screw off and load the page I asked you to, thanks.") IMAO, there is zero reason for an expired certificate to throw this kind of warning.

And there's an argument that there's a good reason for that, but that reason ignores the fact that users have been steadily conditioned to click past the warnings, and most of the time, to no ill effect.

Apparently enough people fail to make the connection that there are plans to apply the same thing to plain http connections sometime in the near future.

[Zikes]

In 2010 China MITM'd 15% of the entire internet[0]. Last month, a Chinese CA issued an unauthorized certificate for the google.com domain[1].

Invalid certificates _need_ to be treated as a major security risk, and an expired certificate is still invalid. The only way the system works is via a network of trust, and if I'm an issuer of certificates I would expect that if I said a certificate I issued is expired, it would be treated as such.

Yes it sucks that managing the certificates is difficult and expensive, and it's great that Mozilla is doing something about that, but the technical foundations on which the current certificate system is built are in place for very good reasons. Encrypting traffic doesn't do any good when you're encrypting on the middleman's terms, and the only way to make sure that's not happening is by verifying the identity of the server you're talking to.

[0] http://www.eweek.com/c/a/Security/15-Percent-of-Internet-Tra...

[1] http://thenextweb.com/insider/2015/04/02/google-to-drop-chin...

[Karunamon]

I think there are two issues being conflated here, the push to encrypt all the things, and common sense encrypting things when you're doing sensitive stuff like entering PII.

For the first use case, using HTTPS, whether it be self signed, expired, bad domain, or whatever the failure mode, is strictly better than using HTTP. It's that simple, because you're providing a layer that does not exist otherwise. Hell, at least if you're getting MITMed, it's you vs the one attacker, not you vs the government and every other kiddie with a copy of wireshark.

For the second one, we care a lot more about the authentication bit.

and an expired certificate is still invalid.

..for no good reason whatsoever. If renewing a cert required a rekey, that would be one thing, but it does not. If an attacker has compromised your private key, nothing is stopping them from going out to your CA with a fresh CSR in hand and regenning the cert themselves! The functional difference between an expired cert and a non expired one is how loud the browser whines about it - you're just as secure, identity has still been verified to the same degree. It's arbitrary and pointless and bureaucratic and causes more problems that it solves, and needs to go away.

if I'm an issuer of certificates I would expect that if I said a certificate I issued is expired, it would be treated as such.

If you're an issuer of certificates, you have a vested interest in making the process to become a competitor of yours as annoying and expensive as possible. (How'd that ~$30k WebTrust audit work out for some of the CA's recently?) You also have no differentiation in product - once you're an accepted CA, your cert is as good as VeriSign's and provides absolutely nothing that theirs does not.

What this means is that the vendors trade on fear, much like antivirus companies used to (and kind of still do) - creating this bogus perception that a signed SSL cert is anything other than a signed SSL cert depending on who you paid and how much.