Well, I'm not sure I agree. The correct answer is determined by how much they care about the risk that someone might be feeding them a malicious script. I think most users care more about the convenience of accessing their favorite site with full functionality than this security problem, as demonstrated by most people's totally lax regard for security in other ways.
(Of course, I'm sure that most users have no idea what clicking 'yes' entails -- I'm just proposing that if they did, they would probably click 'yes' anyway.)
No, you're wrong. If a site has users that don't care about security at all and are happy to have their accounts compromised, the site shouldn't even be using SSL in the first place.
Isn't it perfectly plausible that 80% of a site's users don't give a hoot about security, but 20% do? I don't see any reason not to give the minority SSL (hopefully compromised minimally by non-SSL resources) regardless of whether the majority cares.
| SSL (hopefully compromised minimally by non-SSL resources)
There's a reason browsers don't display a secure logo on HTTPS connections with non-HTTPS resources: it's not secure. It's not "minimally compromised", it's compromised. If my server has one service with one vulnerability, it's not "minimally vulnerable", it's vulnerable.
| I don't see any reason not to give the minority SSL
I was being sarcastic.
| Isn't it perfectly plausible that 80% of a site's users don't give a hoot about security, but 20% do?
It's not even about the users. The site should not ever be mixing HTTP with HTTPS on the same page.
Yeah, I agree with that. It's a stupid problem, but the problem exists, and until we are allowed to forcefully seize the servers of people who implement shitty software and fix the problems, it won't go away, so it's worth trying to do the best thing possible for users.
(Of course, I'm sure that most users have no idea what clicking 'yes' entails -- I'm just proposing that if they did, they would probably click 'yes' anyway.)