Fair enough, it buys you protection from passive attacks (but not man-in-the-middle attacks). However, the browser vendors have spoken, and like it or not, they have decided to show a self-signed certificate in the same manner as a fraudulent one, which means nobody will trust your site. <div class="gmail_quote">On 1 Feb 2013 23:23, "Paul Bone" <<a href="mailto:paul@bone.id.au">paul@bone.id.au</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Fri, Feb 01, 2013 at 11:18:49PM +1100, Matt Giuca wrote: > If you can't get a real one, you are better off not using SSL. All modern > browsers show a huge warning and from a security standpoint it doesn't buy > you much. It does. It means that people can't sniff your password out of the air. We'll investigate getting real certificates, we just havn't do so yet. -- Paul Bone <a href="http://www.bone.id.au" target="_blank">http://www.bone.id.au</a> </blockquote></div>