Comment by pde3
11 years ago
You're absolutely right. From first principles, HTTP should have a louder warning than self-signed HTTPS.
Our hope is that Let's Encrypt will reduce the barriers to CA-signed HTTPS sufficiently, that it will become realistic for browsers to show warning indicators on HTTP.
If they did that today, millions of sites would complain, "why are you forcing us to pay money to CAs, and deal with the incredible headache of cert installation and management?". With Let's Encrypt, the browsers can point to a simple, single-command solution.
Thanks for doing this. It's really great and its something that clearly needs to happen.
The next step will be to replace the CA system with something actually secure, but that comes after we move the web to a place where most websites are at least trying.
We'll be in a position to deploy defenses like pinning (http://www.ietf.org/id/draft-ietf-websec-key-pinning-21.txt) for site operators who want more protection against the structural problems of the CA system. That will need to be implemented with care, but it should be possible.