Eric Gorr wrote: > There does not appear to be many options that lay between > SSL/Certificates (i.e. lots of money) and basically no security > what-so-ever (I would include .htaccess using the basic method among > these). > > The idea of a shared certificate is interesting, but there are warnings > about the certificate not matching the site which would become annoying. > > I'm simply looking for a method between no-security at all and the > SSL/Paid-Certificates method. The equivalent to your "decent deadbolt" is to use a self-signed certificate. Self-signed certificates are free, easy to set up, and they prevent simple eavesdropping. However they are vulnerable to misdirection and man-in-the-middle attacks, so a motivated attacker can break it. This, of course, is already supported by Mozilla and most webservers. The problem you have with this is that all browsers will quite rightly warn you if the site you are attempting to connect to is "pretty secure", rather than "secure". This should not change, regardless of what mechanism for "pretty secure" might become available in the future. Removing the warning would be a disservice to the user. Outside of corporate use, most secure web-browsing is done in order to secure the user's transfer of private information to some server, so what the _user_ thinks of the level of security is far more important than what the webmaster thinks. Charles Miller
