ok, so are you also saying that it is impossible for an attacker to intercept data from a standard HTTP request?
My next point being that if standard HTTP is also vulnerable to such attacks, why doesn't the browser display a warning on EVERY page, telling us that it can not verify the website identify? Thus, all things being equal, I would assume that unverified, but encrypted is still better for the user than unverified AND unencrypted.
...but I've probably misunderstood something fundamental here (as is often the case!)
Comments
ok, so are you also saying that it is impossible for an attacker to intercept data from a standard HTTP request?
My next point being that if standard HTTP is also vulnerable to such attacks, why doesn't the browser display a warning on EVERY page, telling us that it can not verify the website identify? Thus, all things being equal, I would assume that unverified, but encrypted is still better for the user than unverified AND unencrypted.
...but I've probably misunderstood something fundamental here (as is often the case!)
HTTPS claims to secure the connection, so it is necessary to make clear when these claims aren't justified.
HTTP makes no security claims, no there's no "unexpected lack of security" to disclose.
Imagine that you're trying to connect to https://mail.google.com. Your browser receives a self-signed certificate. What should it do?