Encryption ensures that only the entity you are sending the message to can read it. If you can't be sure of the entity you are sending the message to, then what's the point of encrypting it in the first place?
Why does the article pick out Mozilla in particular? Are they suggesting that FireFox makes it overly complex to ignore the warning and continue on?
Firefox 2 behaved similar to other browsers, giving one warning dialog for self-signed certs. People are complaining because Firefox 3 changed that to an annoying 4-step process.
Encryption without authentication is just that: encryption. The point of encryption is to make sure no one else is listening OR modifying the data in transit. Like, say, your cash-starved ISP, or the government.
No, it's not. If a man-in-the-middle attack is possible (certainly the ISP could), then encryption without authentication is as insecure as no encryption at all. And in fact worse if the user has a false sense of security.
The MITM pretends to be the bank's server (or whatever) when talking to you, and pretends to be you when talking to the bank's server. Both channels can be encrypted, but the attacker still sees (and can modify) everything that you think you're sending directly to the bank's server.
This is the key point that most people seem to be missing here. If browsers didn't warn about self-signed certificate, the entire system would break down because an attacker could just use a self-signed cert in a MITM attack, and the user would have no idea.
Encryption ensures that only the entity you are sending the message to can read it. If you can't be sure of the entity you are sending the message to, then what's the point of encrypting it in the first place?
Why does the article pick out Mozilla in particular? Are they suggesting that FireFox makes it overly complex to ignore the warning and continue on?