Mike and Kljuka: if you’re sending sensitive data, then obviously you want a certificate issued by a legit authority. What’s STUPID, however, is that Firefox makes it seem like sites using a non-trusted CA for their SSL are LESS SECURE than sites with no SSL. That is false, and if you’re stating otherwise it’s because Verisign or someone similar is paying you to say so (or you’re a flaming idiot).

As a coda, I’d note that certificates issues by the UNITED STATES GOVERNMENT and the DEPARTMENT OF DEFENSE are considered non-secure and non-trusted by Firefox because DOD isn’t in the habit of paying off browser companies to trust their root certificates.

If you want to send some sensitive data to example.com, you want to be sure, you’re sending the data ONLY to example.com.
If you’re not using CA, you might be sending data to hacker_a.com, which is forwarding all data to example.com (so called “man in the middle attack”) and you won’t see any difference.
CA only makes sure, you’re really sending the data directly and only to example.com.
And it’s up to you, to choose which sensitive data example.com should have possession of (that is usually the main concern in real life).

The point I’m making is, the internet would be far more secure if everyone used certificates, self signed or CA signed. If there were open CAs (there are couple now) that were free or reasonably priced, then we can do away with the monopoly help by the big CAs, who aren’t doing a better job than anyone else.

It seems to me that if Firefox and IE really cared about security, they should throw an ugly warning on EVERY page that isn’t HTTPS. Because there you’re truly unprotected.

This is simply incorrect. Certificates do not just offer encryption over the connection, they also offer identity verification. The whole point of a CA (Certificate Authority) is that you can trust it to verify the identity of the owner of any issued certificates (though this system is not perfect either). Self signed certificates do offer encryption of the data, but what is the point of encrypting the data if you don’t know who you are sending it to?