There are ways to determine if a site is secure without attempting to gain unauthorized entry. You can look for third party certifications, a valid SSL certificate, etc. This is similar to the analogy of looking around at your bank to see they have a security person, locks, cameras, etc. protecting your safe deposit box. You don't go try to break into the bank to determine if it's reasonable to put your assets in the box there.
That's an absurd analogy. A more apt analogy would be to check if the bank had bothered to lock it's back door, while waving at the security cameras.
Prevent this kind of scan makes all of us less safe, since it encourages negligent behavior like taking risks with data that's not yours. Frankly, I think website owners should be held liable for security vulnerabilities.
This kind of culture of systematically undermining a secure internet only serves those who abuse our trust. Do you honestly think the FBI has a chance in hell of actually catching more than a minute fraction of all malicious hackers? Not to mention the fact that their motives here and elsewhere are rather questionable - if anything, they're less benign than the hackers they're chasing, seeing as they're essentially untouchable for whatever damage they cause.
No, not really. It's the wild west. SSL certs don't do anything to prevent SQL injection. That's done at the application layer, not the transport layer. You seem to be out of your depth.
This is equivalent to "checking to see if the door is unlocked when it should be locked" not "trying to pick the lock after hours"
I'm not out of my depth, this is what I do for a living. Verifying that a site is using valid SSL is one of the myriad of tools at your disposal to make sure a site is taking reasonable safety precautions with your data. That, accompanied by a third party trusted certification that indicates some basic penetration testing has been performed is reasonable protection for almost any data you'd be putting on the internet.
If you think that verifying that a site is using valid SSL is a tool to make sure that a site is taking reasonable safety precautions with your data, you most definitely are entirely out of your depth.
As to trusted certification - please elaborate; because many of these "certifications" are entirely worthless (some indeed indicate that a site is less likely to be safe).
Yeah, it's like driving by a house and seeing a sign on the lawn "This house is protected by Brinks" and from that concluding that none of the doors or windows have been accidentally unlocked.
It does show some kind of theoretical preference for security but it by no means assures one -- nevermind making any kind of a guarantee -- that said preference has been successfully translated into reality.
I would suspect that the rate windows or doors left accidentally unlocked between houses with security systems and without isn't a substantial enough difference to be meaningful. Sure the right might drop in half, but if it's from 4% to 2% that doesn't do much.
Having an SSL certificate is really the bare minimum that someone can do to have even a hope of a prayer of keeping data safe. There are about a dozen steps beyond that which must be taken. Worse, the effects are not additive, but multiplicative. If any one particular defense is handled improperly the properly handled other portions lend little/no assistance.
Naively one might assume that the total security score might be tabulated this way:
