Comment: Re:A true story (Score 1) 439
Using self-signed certs for these sorts of things is more secure.. theoretically. In practice, I'm not so sure, the grandparent has a good point. By using self-signed certs you rule out MITM, but that's only when the following assumptions are also true:
* The device has the self-signed cert installed.
* The device recognized the aforementioned certificate as the *only* valid certificate for a given website.
In practice, many (most?) phones do not support installing arbitrary certificates. I've never encountered even a desktop browser that allows me to configure a cert as being the only valid certificate for a given website. For these reasons, using self-signed certificates actually trains your user to always click 'Yes' when they see a certificate warning, and they were already clueless about security to begin with. Even if the device supports installing self-signed certificates, without enforcement one can hack into a CA, create a false certificate, poison the user's DNS and redirect traffic to his MITM website.