6 ms·
You can't assume protection, whereas with http you assume no protection. So, if you can't trust certificate (not when it is invalid), just show same level of p
by dm33tri 7y ago
You can't assume protection, whereas with http you assume no protection.
So, if you can't trust certificate (not when it is invalid), just show same level of protection as http.
- zozbot234 7y agoThe problem is that a http: protocol specifier implies no protection; the moment you follow the link, you know that the connection is not secured. Whereas a self-signed https: connection could be due to someone MITM'ing a site that generally uses CA's, in which case "no warning message" implies that the site is secured. The browser message has to make it clear to the user that something possibly unexpected is going on.