But web browsers (firefox, internet explorer, chrome, opera, safari, etc.) have decided to combine this idea of verifying the identity of the company running a website with the mechanism for establishing a secure connection protocol from your browser to the website (https). Secure connections can be very important in preventing neighbors and snoops from discovering your login passwords, etc. as you browse the web.-mouser
Hm, "web browsers have decided"? SSL, which offers both confidentiality and authenticity, was in place - web browsers simply chose to use the
standard rather than inventing some new and fancy scheme.
I agree that SSL certificates is a b*tch, though, and that the CAs are a rotten charge-trough-the-nose mafia - it's a disgusting business. I'm surprised that (if?) startSSL is part of the OS/browser pre-accepted authorities, since their services sound almost too good to be true.
As for the warnings browsers do on self-signed certificates, well, I'm afraid that they
do have to be somewhat severe. Outside of special services, or corporate intrawebs (where you can usually manage rolling out custom corporate CA certs to the invididual machines anyway), self-signed certs would usually be a sign of something bad going on. Regular users can't be expected to understand WHAT this is all about, and even less to verify certificate fingerprints, so not complaining loudly about self-signed certs == free lunch for man-in-middle attacksers.
The
real problem is how expensive certificates are, and how you're charged for them (paying extra for "real verification" and "stronger encryption", not to mention the horrible domain fees; all the CAs I've been looking at previously easily classify as con-men), not to mention that security isn't all that hot anyway (good old social engineering skills against the CAs). But the mechanism itself isn't to blame, and I honestly can't think of a decent security infrastructure that
doesn't depend on CAs.