&gt; Certificates are free? Some are. Do you trust certificates given without checking the real identity of the user? I do not. It has a cost. If you do not check you have the perfect tool for a MITM.<p>But you just said that HTTP was fine, right? You can MITM plaintext HTTP too, so I don&#x27;t understand why that&#x27;s a problem for HTTPS to be (potentially) MITMable.<p>&gt; Of course you idiot.<p>I have stopped reading here. Please read <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html</a>