Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Nicolas Williams <[e-mail]>]

On Wed, Jun 30, 2010 at 03:40:31PM -0700, Seth David Schoen wrote:
> Nicolas Williams writes:
> > In particular it's important to distinguish sites that serve HTTPS just
> > because from sites that serve HTTPS because they really ought to, and
> > from sites that serve HTTPS as part of being attack sites.
> 
> In an earlier message in this thread you suggested that "sites that
> ought to be using HTTPS with valid certs" were "banks, payment sites,
> shopping sites that accept credit cards, etcetera".
> 
> I think one of the most positive developments of the past two years
> has been the increased recognition that financial information is
> not the only information that is private or sensitive, and hence not
> the only information that should be protected with HTTPS.  Thus we
> have HTTPS available for webmail, search engines, social networking,
> an encyclopedia, blogging and microblogging platforms, government
> agencies, newspapers, and direct-to-consumer DNA testing services.

Quite true.  All services where user accounts are valuable should be
protected.  That might still be a tiny fraction of the number of hosts
reachable via the Internet and that serve HTTPS :(

> Many Internet users regularly give their credit cards (complete with
> CVV2!) to strangers in stores and restaurants, maybe a half-dozen
> times a day, but would never want the people they encounter in their
> daily lives to know what they search for on Google or Wikipedia.  We
> can make a lot of progress for privacy and information security by
> further breaking the reflexive association between HTTPS and credit
> card numbers and the stereotype that there's only one kind of web
> site for which HTTPS is appropriate.

I'd be ecstatic if we knew that at least retail and banking were secure
enough.  That's where I'd start, but maybe I'm misguided.  I imagine
that for many people (e.g., teenagers, who usually have little in the
way of finanacial resources, but much in the way of free time) starting
with social media is probably more important.