Comment Re:Frist Psot! (Score 3, Informative) 236
Luckily, BBC News is run on the British TV Licence and can't - by power of it's charter - put adverts or start charging for anything.
Luckily, BBC News is run on the British TV Licence and can't - by power of it's charter - put adverts or start charging for anything.
SSL isn't meant just for encrypting pages, it's meant for verifying identity also.
As the article says. SSL does both. FF3 in particular makes the first completely unusable for no good reason. The web would unquestionably be more secure if all http servers switched to using self-signed SSL certificates in place of unencrypted connections.
And this is where you're wrong. There's no point to encryption, unless you know who you're talking to.
Anyone sophisticated enough to sniff your traffic can also hijack it without much trouble. If they can hijack it, then you don't know if you're talking to the intended recipient or a hijacker (who in turn is talking to the intended recipient). This is the definition of a man-in-the-middle (MITM) attack.
The very design of SSL and its use of certificates with a chain-of-trust assumes this. Without this assumption, Diffie-Hellman key-exchange is simpler and sufficient. None of the RSA/DSA stuff with certificates would be necessary.
Happiness is twin floppies.