Hacker News Reader

Funny that this was written after Jeff Atwood left Stack Exchange.

To be fair, Jeff Atwood recently left Stack Exchange (amicably, of course): http://www.codinghorror.com/blog/2012/02/farewell-stack-exch...

I thought is last day was March 1?

or... have i been working on this bug for way to long?

Well, it's a cert for stackexchange.com and not stackoverflow.com.

They need to be serving a different cert on a different IP for that (ignoring SNI since not all browsers support it).

Ironic, but there's virtually nothing private on SO.

Training users to click-through security warnings diminishes the security for all sites.

That was actually my first thought after reading this. Chances are, people in public wifi spots will actively and aggressively ignore any and all warnings that get in the way of them getting their work done (I have witnessed this far too many times).

However, Chrome surprised me the other day by not allowing me to continue on to a site that didn't have a valid certificate (I was MiTM myself using PAROS proxy to test something). In other words, we don't need stricter warnings, but the warnings must become errors for them to be noticed.

... except your login cookie. :)