With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to prevent an attack, assuming that the attackers can't manage to get a valid certificate somehow.
The average error page or error message says something along the lines of "There's a problem with this site's security certificate, and this may mean an attempt to intercept the data you're sending to the server." Admittedly, this is a bit wordy, but I believe it's short enough to keep a user's attention and has enough detail (without going into too much detail) to let the user know that it's not just a "You win a free car and $1,000,000!!!!" sort of thing. There's also that typically the error pages are intrusive and minimally flashy, which I believe will catch the user's attention but not divert it away.
Since this is a fairly subjective question, I'm going to make it as objective as possible: In your experience, what is the average user's reaction to warning pages like this?