Given that one can get a CA-signed certificate for free, and that in any case the cost of a cert is dwarfed by the cost of running a nontrivial website, I think you overestimate the number of sites which would be "secured" in this manner and the gains to be had.

But the important point is what we'd lose: If a UA accepts a SSC for an arbitrary website, then the NSA can actively MITM a website that uses a CA cert -- the browser will never see that CA cert, so it doesn't know better.

The only way around this would be to accept SSCs but treat them as no different from plain HTTP in the UI. But now websites have no incentive to use the certs in the first place, further limiting the benefits to be had.

Really, just buy a certificate. It's not that hard.

> That would be a major and totally free improvement in privacy for everybody.

Tangentially, I feel like you're trying to have it both ways in arguing for more encryption on the web and also against mandatory encryption on the grounds of energy efficiency. SSCs wouldn't be "totally free" under your model -- we'd be spending carbon on it. I might argue that if one is going to pollute to encrypt their data, it would be unethically wasteful to use a SSC, which comes at exactly the same environmental cost as a CA cert but offers much weaker guarantees.

> The only way around this would be to accept SSCs but treat them as no different from plain HTTP in the UI. But now websites have no incentive to use the certs in the first place, further limiting the benefits to be had.

That, or make HTTP/2's non-secure mode always be encrypted. Which is what people like myself would like. Opportunistic encryption at zero hassle and with zero security problems.

If it were a foregone conclusion that HTTP/2 would have a non-secure mode, I'd agree, yes. But in practice HTTP/2 isn't going to have a non-secure mode in most browsers.

Maybe you're arguing that it would be better to have an insecure but encrypted mode in all browsers? Could be, but I don't think so. As it is, if a site wants the benefits of HTTP/2, they have to establish actually secure communication (inasmuch as CAs provide that). It seems good to me to use the performance benefits of HTTP/2 as a carrot to accomplish real encryption everywhere. If the costs of getting a cert were too high, then maybe this would leave many websites stuck on HTTP/1, which would be worse than having those sites use an encrypted-but-insecure mode in HTTP/2, but I don't think that will be the case.

>Maybe you're arguing that it would be better to have an insecure but encrypted mode in all browsers?

Pretty sure this is what we're doing today with smtps. We just wrap smtp in tls and call it a day. Its dangerous and allows for mitm attacks. I think there was a paper recently about how this is already being abused.

I just dont see where people who believe in self-signed certs as a solution to all our encryption woes are coming from. Its historically and technically has shown itself to be a security nightmare for most use cases. I think people like this are more political than practical and think they can do non-trivial things without regulation, authorities, etc. Sorry, but that's just not how this world works.

Of course you are right re environmental pollution with either certificate type. Phk is also speaking about caching reverse proxies. Why should you encrypt everything when being in your own private network.