The End of Self-Signed Certificates?

Instead of paying $100 per year (typically) for a secure certificate, many websites use a "self-signed" certificate, meaning that one of the big network agencies hasn't vouched for their credentials. The benefit to the web developer (and to users) is that a secure (encrypted) web connection can be created. The downside is that the user will be prompted upon a first visit to accept the certificate, and the risk that the site and its certificate might be fraudulent. This risk is minimal for low-profile sites (who may not have the money for a certificate) who have little risk of being spoofed via spam emails for instance. Some examples [from my own web dev experience] would be webmail for a small non-profit or a protected wiki for a small to medium sized science team. In these cases, users can be informed in advance of what to expect on the first visit, and one can be reasonably sure that hackers have not set up sites with similar URLs and content to trap the unwary.

And, for what it's worth, self-signed certs are not significantly less secure or less risky than normal certificates. A hacker can obtain a minty-fresh cert for a spoof site just as easily as a legitimate site--it just means the hacker was willing to part with $100 (or whatever it is) in pursuit of far more valuable rewards. [Update: This was just plain wrong, as indicated by the comment below, self-signed certs are only as secure as the method used to distribute them.]

But I just noticed in the new Firefox (3.0 beta 2 for Mac), that accepting a self-signed certificate is now a four-step process with messages designed to scare you away from accepting such a cert. Read the rest of this entry for screenshots. I think this will be sufficient to dissuade many users from accepting a self-signed cert, no matter what they have been told up-front.