Hacker pokes third hole in secure sockets layer

Basically the frantic, irritating, multi-click "consumer-scaring" dance that Firefox 3 does every time it sees a self-signed certificate is kind of pointless, since "bad guys" don't need to use them...

Oh good, I'm not the only one who is annoyed by that. It is pointless-- how can anyone be qualified to judge if it's genuine or not? Typical Microsoft-style "security"-- bug the user with a bunch of annoying click this and check that, and it's all meaningless.

Yeah.

I mean, how many sites out there use a: self signed certs or b: the cert from their web hosting provider that doesn't have their site listed in it?

I see the point of warning you, but most users wouldn't know what it's warning about, let alone know how to verify if it really is valid for that site.

The SSL model is flawed anyway, and it doesn't have anything to do with technical limitations or problems.

The biggest problem is that any criminal can buy an SSL certificate at Thawte & co. I once saw a malicious site with a perfect Thawte SSL certificate. Companies such as Thawte don't look at who they are selling certificates to. It's the same as a government selling ID's to everyone who pays for them and then complaining those ID's are unsafe because the RFID-chip is cracked; utterly irrelevant information.

The problem here with Thawte is the same as the problem with USPTO / EPO: They are not paid for quality but for quantity. As long as trolls and criminals increase that quantity, they will be sold patents and SSL-certificates.

Only if a company such as Thawte would have to pay a fine for every SSL-certificate it sold to malicious groups, something would really change. Untill then, an SSL certificate is totally meaningless, and worse, providing a false feeling of security. But that's just my 200.

Thing is one man's malicious group is another man's pillar of capitalism...or elected government.