like say at an airport or a grocery store chain. I'm sure there's tons of engineers that think like you that work at big companies and don't want to https their local websites but you do so at great risk if you have any public facing terminals. You could even take over DHCP duties by answering broadcasts first and make machines think you're also the real DNS server. You only need to tap into an ethernet jack and spoof some other mac address on the network that you happen to see nearby. The costs to accomplish this are low as well. If someone overrode the local DNS for say google's domain to instead point to some local IP instead of the real google server they could introduce arbitrary javascript to a real script and simply forward all requests to the real server then proceed to start stealing session cookies among other things by appending some of their own javascript to the official code. This is actually way worse than someone opening a trojan cause you can hack people who do everything right and are seemingly unaware that their DNS has been hijacked. I cannot accept that this is better than nothing when false indications of security are considerably worse. At any time anyone actually able to intercept your traffic can tweak responses to pass automated tests and get themselves a valid cert for your domain and MITM all of your traffic without anyone knowing. How is SSL better than nothing in that case? At least with nothing you are not under a false impression of security.

Is it better? Lets say you are worried someone will intercept your traffic. So unless you've got the attention of some pretty powerful groups, the risk that you are talking to something not operated for/by microsoft is pretty low. Microsoft can, its likely some state actors can coerce trusted root CAs to do it. If you at least have to get over the hurdle of demonstrating you control before claiming your server is that's an improvement on the baseline case. Proving you have control over DNS on the domain to get a cert is better than nothing. The NoScript Firefox extension provides extra protection for Firefox, Seamonkey and other mozilla-based browsers: this free, open source add-on allows JavaScript, Java, Flash and other plugins to be executed only by trusted web sites of your choice (e.g.

Firefox blocking https